fix: adopt pnpm 11.6.0 and the consolidated pr-review workflow

.githooks/commit-msg

@@ -1,2 +1,7 @@
 #!/usr/bin/env bash
-npx -y conventional-commit-msg "$1"
+# `@latest` + explicit `--package` dodge two npm footguns: an inherited
+# npm_config_package (agent wrappers like axexec/axrun set it, hijacking
+# `npx -y` into exit 127), and local-root shadowing — without the version,
+# `npm exec` resolves the conventional-commit-msg repo's own package and the
+# bin is "not found", breaking the hook in that repo after prepare wires it up.
+npm exec --yes --package=conventional-commit-msg@latest -- conventional-commit-msg "$1"

.github/workflows/pr-review-on-open.yml → .github/workflows/pr-review.yml

@@ -1,9 +1,9 @@
 ---
-name: PR Approach Review
+name: PR Review
 
 on:
   pull_request_target:
-    types: [opened]
+    types: [opened, synchronize, reopened]
   workflow_dispatch:
     inputs:
       pr_number:
@@ -12,7 +12,8 @@ on:
         type: number
 
 jobs:
-  review:
+  approach:
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.action == 'opened' }}
     permissions:
       contents: read
       pull-requests: write
@@ -25,3 +26,17 @@ jobs:
     secrets:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       AXRECIPE_API_KEY: ${{ secrets.AXRECIPE_API_KEY }}
+
+  code:
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
+    uses: Jercik/axgithub/.github/workflows/pr-review.yml@v1
+    with:
+      label: code
+      recipes: '["pr-review-code-1","pr-review-code-2"]'
+      pr_number: ${{ github.event.pull_request.number || inputs.pr_number }}
+    secrets:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+      AXRECIPE_API_KEY: ${{ secrets.AXRECIPE_API_KEY }}

package.json

@@ -81,5 +81,5 @@
   "engines": {
     "node": ">=24.0.0"
   },
-  "packageManager": "pnpm@11.5.1"
+  "packageManager": "pnpm@11.6.0"
 }