fix(ci): avoid running pr reviewer on closed prs

[Hweinstock]

Problem

#1463

Solution

• add an explicit gate on the workflow to not continue unless the PR is open.

Testing

curl -s https://api.github.com/repos/aws/agentcore-cli/pulls/216 | jq '{state}'
   
  {
    "state": "closed"
  }

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Package Tarball

aws-agentcore-0.19.0.tgz

How to install

gh release download pr-1536-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.19.0.tgz

[agentcore-cli-automation]

Looks good to merge. The added gate is a sensible defensive check — even though the workflow only triggers on opened/reopened events, explicitly verifying pull_request.state == 'open' protects against stale/replayed events (which is what issue #1463 describes). The condition correctly skips the check for workflow_dispatch runs.