feat(discussion): add support for Discussion Templates - #14017

Checking the pull request head out means this job executes that PR's code —
install lifecycle scripts included — while holding a subscription token,
`pull-requests: write` and `actions: write`. The owner gate does not cover
that. It decides who may TRIGGER a review, not whose code then runs, and the
ordinary sequence is the dangerous one: a stranger opens a pull request, the
owner reads it and comments `@claude review`.

`ci.yml` builds fork pull requests safely because `pull_request` hands it a
read-only token and no secrets. This job has both, and `actions: write` widens
it further, since a poisoned cache entry outlives the run and is restored by a
later job on `main`.

So the head must be a branch of this repository. The `issue_comment` payload
cannot answer that — `issue.pull_request` carries only URLs — so it is resolved
through the API in a step that runs before anything is checked out, and the
job stops with a readable error otherwise. Reviewing a fork stays possible by
hand, which is what it was before this branch.

Resolving the SHA rather than trusting `refs/pull/N/head` also closes the
window between the check and the checkout, since that ref moves when the
contributor pushes.

Verified both directions against live pull requests: this one resolves to
saeedkolivand/crosskit and passes, and cli/cli#14017 resolves to jamietanna/cli
and takes the exit path.

Install scripts stay enabled rather than `--ignore-scripts`, now that the code
is this repository's: an install that differs from the one `ci.yml` performs
would have the review measuring something other than the gate, which is the
failure this branch exists to fix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: let the PR review run the code instead of only reading it

Every review this cycle closed with the same line: "I could not run the gate:
this checkout has no node_modules and pnpm install isn't in this job's allowed
tools." So every finding was reasoned from the diff — and in this repo the
questions that matter most are the ones reading cannot settle. Does the
assertion still fail when the fix is reverted? Does a green jsdom test survive a
real browser? Both have hidden a real bug behind a passing suite here.

Dependencies are installed and packages built in the workflow rather than by the
agent: the lockfile stays frozen, the pnpm store cache applies, and the
allowed-tools list never needs a command that mutates dependencies. Building
also matters because the playgrounds import dist rather than src, so without it
a suite the review runs would measure whatever was last built.

Chromium is installed because the browser suite is the one that catches what
jsdom structurally cannot — inert blocking focus, and which of two overlapping
fixed elements a press reaches.

The system prompt now asks it to reproduce before reporting, to revert a fix and
confirm the test actually fails before calling coverage adequate, and to mark
anything it could not reproduce as unconfirmed.

Allowed tools are read-and-run only: no install, no write, no push.

* ci: check out the pull request, not the default branch

Round 1 review, four findings, each confirmed against evidence rather than
taken on the reviewer's word.

The one that mattered: an `issue_comment` event points GITHUB_REF at the
default branch, so the checkout landed on `main` and every step this branch
adds — install, build, browser download — would have run against main's tree.
Confirmed in the log of the review that raised it, which shows
`git checkout --force -B main refs/remotes/origin/main` before the action does
its own checkout of the PR branch. The build writes `packages/*/dist`, which is
gitignored and therefore survives that switch, and the playgrounds import it —
trap 2, automated. That is strictly worse than what it replaces: today a review
says it could not run the gate; with the wrong ref it reports a confident green
measured against main. Pinned to `refs/pull/N/head`.

Reviews have opened by saying they cannot post inline comments, and the pin
explains why: the inline-comment MCP server starts only when `--allowedTools`
names one of its tools, and tag mode's own list does not
(install-mcp-server.ts:80,138-142; modes/tag/index.ts:123-133). The comment
claiming tag mode grants them was wrong; naming the tool is what starts it.

Tag mode runs `--permission-mode acceptEdits` and already allows `git add` and
`git commit`, so telling the reviewer to delete code and confirm a test fails
handed it a way to mutate the tree and no way to put it back. Added the restore
verbs and an instruction to leave the tree clean and never commit.

`test:browser` did not exist on the branch this was cut from, only on the one
that has since merged. Rebased, both suite names are real, and the prompt now
says they are disjoint rather than implying one covers the other.

Also: the action's post step was failing with "cache write denied: token has no
writable scopes". An explicit permissions block makes every omitted scope
`none`, so `cache: pnpm` was inert in both directions and every review
cold-installed. Timeout raised to 45 for the work the job has gained, since a
killed job posts nothing at all.

Corrected two comments that claimed more than the file delivers: installing in
the workflow does not stop the agent mutating dependencies, because
`Bash(pnpm --filter:*)` is a prefix rule that also matches `pnpm --filter x add`.
The owner gate is what bounds this job, and it now says so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* ci: run the review only on branches of this repository

Checking the pull request head out means this job executes that PR's code —
install lifecycle scripts included — while holding a subscription token,
`pull-requests: write` and `actions: write`. The owner gate does not cover
that. It decides who may TRIGGER a review, not whose code then runs, and the
ordinary sequence is the dangerous one: a stranger opens a pull request, the
owner reads it and comments `@claude review`.

`ci.yml` builds fork pull requests safely because `pull_request` hands it a
read-only token and no secrets. This job has both, and `actions: write` widens
it further, since a poisoned cache entry outlives the run and is restored by a
later job on `main`.

So the head must be a branch of this repository. The `issue_comment` payload
cannot answer that — `issue.pull_request` carries only URLs — so it is resolved
through the API in a step that runs before anything is checked out, and the
job stops with a readable error otherwise. Reviewing a fork stays possible by
hand, which is what it was before this branch.

Resolving the SHA rather than trusting `refs/pull/N/head` also closes the
window between the check and the checkout, since that ref moves when the
contributor pushes.

Verified both directions against live pull requests: this one resolves to
saeedkolivand/crosskit and passes, and cli/cli#14017 resolves to jamietanna/cli
and takes the exit path.

Install scripts stay enabled rather than `--ignore-scripts`, now that the code
is this repository's: an install that differs from the one `ci.yml` performs
would have the review measuring something other than the gate, which is the
failure this branch exists to fix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>