feat(claude-lanes): unpark security-review caller for provisioning

[kyle-sexton]

Summary

Unparks claude-security-review-caller for private adopters (path (b) from #377), with melodic-software/provisioning as the first managed target.

• Move cancel-in-progress: false to job-level concurrency on security-review so the caller can coexist with concurrency-policy (delegated-job-level shape).
• Manage the component for provisioning in the sync manifest.
• Rewrite parking docs so the remaining public/shared-shape blockers from Unparking claude-security-review-caller costs more than the runner indirection alone #377 stay recorded (cross-repo routing kind, blanket public-target test, plugins evidence/skip-actors) without filing a follow-up issue.
• Align the claude-code-plugins locally-owned removal trigger with that same three-part bar.

Fixes #377

Related

• Issue Unparking claude-security-review-caller costs more than the runner indirection alone #377 scoping note (private unpark vs public/shared-shape blockers)
• distribution/README.md Claude review-lane caller parking prose
• Prior parking introduction in feat(distribution): add sync-managed claude review-lane caller components #286

Verification

• node --test --test-name-pattern='claude lane|managed target of a claude|selector-routed claude' components/runner-policy/runner-policy.test.mjs — 4/4 pass
• Standalone actionlint of materialized security caller — clean
• bash distribution/sync-manifest.sh validate — valid
• Clean-config apply to a provisioning stand-in materializes both lane callers

Follow-through (same session)

• Merge sync PR into provisioning after this lands
• Ship repo-owned .github/claude-security-paths starter in provisioning
• Do not add security-review / security-review as a required check yet (frontier consensus: observe advisory first)

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/standards/actions/runs/31670287740
• Failure class: rate-limit
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":291,"total_cost_usd":0,"api_error_status":429,"class":"rate-limit"}

Re-run the job, or workflow_dispatch this workflow with the PR number, to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2c88b251bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".