ci(review): route Claude review through fleet

[kyle-sexton]

Summary

• route the Claude review reusable caller through the repository's governed runner selector
• pin the fleet-capable reusable workflow and pass the selector result with the established hosted fallback
• remove the now-obsolete hosted-runner exception

This advances melodic-software/github-iac#78.

Dependency

Depends on #140 plus the generated runner-policy sync. Current old-policy CI may fail or queue until then. This is intentionally a dependency-blocked draft.

No managed files were edited; this changes only the repository-local caller and repository policy exception.

Validation

• actionlint
• git diff --check
• direct analyzer pass using the exact feat(runner-policy): review privileged reusable callers #140 head
• signed commit verified

[claude]

Claude finished @kyle-sexton's task in 2m 35s —— View job

---

PR Review

• Gather context (PR metadata, branch state)
• Inspect commits and diff
• Read relevant files
• Post review findings

---

Summary

This PR currently has zero net changes versus origin/main. All three branch-local commits cancel out by the time of the merge-sync (ab6fb82):

Commit	Intent	Net effect
efb268e	Route review through fleet: add select-runner job, drop policy exception, bump pin	+18 lines / −5 lines
7e821c7	Revert to always-hosted: re-add exception, drop select-runner, hardcode runner: ubuntu-24.04	Largely reverses efb268e
ab6fb82	Merge sync from origin/main (which carries df54d0e pin via related work)	Final diff vs main = zero

Merging this PR as-is would be a no-op squash commit.

---

Findings

🔴 Important — PR description does not match the committed state

The PR body describes three outcomes that were explicitly reversed by 7e821c7:

• route the Claude review reusable caller through the repository's governed runner selector
• pass the selector result with the established hosted fallback
• remove the now-obsolete hosted-runner exception

Commit 7e821c7's own message acknowledges the reversal: hosted-exception-required remained unresolved after the fleet-routing commit, so the approach was changed to always-hosted and the exception was restored. The PR description was not updated to reflect this pivot. If the PR is still meant to land the original fleet-routing design, the prerequisite (clearing hosted-exception-required in the upstream ci-workflows contract) needs to be met first. If the goal shifted to the always-hosted approach, the title and summary need to be rewritten to describe what 7e821c7 actually does.

🔴 Important — Zero diff makes the PR unmerge-able in a meaningful sense

After ab6fb82 merged origin/main (which itself received the df54d0e pin through related upstream work), the branch is byte-for-byte identical to main. The intended change — whichever form it takes after the description is reconciled — needs to be re-introduced on top of the current main HEAD before this PR can be reviewed on its substance.

---

Observations on 7e821c7's approach (for when the PR is re-worked)

The always-hosted reasoning in 7e821c7 is sound:

• The privileged-control-plane exception category fits: the job mints a Claude OIDC token and writes PR feedback with pull-requests: write, matching the publish-packages.yml#publish precedent already in runner-policy.json.
• Keeping the exception rather than routing through the fleet avoids a hosted-exception-required policy violation in the upstream contract — a constraint that would need to be cleared in ci-workflows before fleet routing is viable.

If the PR pivots to the always-hosted design, the changes in 7e821c7 (exception retained, runner: ubuntu-24.04 hardcoded, no select-runner job) are consistent and properly justified. The new pin (4dbb0df → df54d0e after sync) just needs to be the one the PR lands with, verified against the ci-workflows commit date comment convention.

---

Recommended next steps

1. Decide: is the goal still fleet routing (requiring upstream ci-workflows work to clear hosted-exception-required), or always-hosted with a policy exception?
2. Rewrite the PR title and summary to describe the chosen approach.
3. Rebase the branch onto current main and re-introduce whichever change set matches the decision, so the PR carries a non-zero diff.

No blocking criteria from REVIEW.md (secrets, injection, authorization) apply to the zero-diff state; the security posture of the current file on main is unchanged.

[kyle-sexton]

Closing as superseded — this branch has since converged to be byte-identical to main (zero diff after merging main in). #140 (allowedCallerPermissions validation for the exact ci-workflows SHA this PR pinned) and #148 (bumped the claude-review pin further to a newer, natively hosted-only SHA) both merged and independently arrived at the same conclusion this PR's own final commit had already reached: claude-review stays hosted-only, no fleet routing needed. Nothing left here to merge.