Consolidate AI review workflows and documentation

[zhongkechen]

Summary

• use one reusable workflow per model with separate, scoped generation and publication jobs
• let consuming repositories enable Claude and Codex independently through default-true boolean inputs
• let consuming repositories override each reviewer model and reasoning effort independently
• default both Claude and Codex reasoning effort to xhigh
• validate model and reasoning inputs before passing them to either CLI
• skip protected-environment approval when both reviewers are disabled
• visibly label every inline comment as a Claude or Codex AI review
• move setup guidance for each shareable workflow into dedicated docs and simplify the README index

Testing

• bash tests/test_ai_review_inline_cleanup.sh
• bash tests/test_post_ai_review.sh
• python3 -B -m unittest tests/test_ai_pr_review_workflow.py tests/test_prepare_ai_review_comments.py (13 tests)
• parsed all workflow YAML files with Ruby Psych
• git diff --check

[github-actions]

High: Claude Code does not support xhigh for --effort; valid levels are low, medium, high, and max. With this default, both Claude attempts fail before producing a review. Use max for the strongest effort and remove xhigh from the validator, public workflow default, documentation, and tests.

[github-actions]

Codex AI review

Found one high-impact configuration issue. The workflow tests only assert YAML literals, so CLI option compatibility is not covered.

Reviewed commit 168ade24b88555803a3b407a204eaad6e39a8086. Workflow run

[github-actions]

Claude AI review

This PR consolidates the AI review workflows (folding the separate *-review-comment.yml publication workflows into a post job inside claude-review.yml/codex-review.yml), adds per-reviewer enable flags and model/reasoning-effort inputs with validation, labels inline comments by reviewer, and moves per-workflow docs into docs/.

I reviewed the changes for correctness and found no actionable defects:

• Input handling is correct for both trigger paths. format('{0}', inputs['x']) != 'false' and inputs['x'] || 'default' correctly handle the empty inputs context on direct pull_request_target runs as well as workflow_call defaults. The approve_review short-circuit and per-reviewer if guards are logically consistent across the trusted/fork/dependabot/draft matrix.
• Permission boundary preserved. The caller grant changed pull-requests: read → write, but the generate jobs still self-declare pull-requests: read and only the new post jobs declare write, so the model still runs read-only.
• Injection surface is guarded. Model IDs are validated against ^[A-Za-z0-9][A-Za-z0-9._:/-]*$ and reasoning effort against an enum before use; the Codex model/effort are additionally double-quoted in the shell command.
• Reviewer labeling (prepare_ai_review_comments.py) is additive to the published body, does not affect the dedup key or comment marker, and tests were updated accordingly.

Residual test risk: No test exercises the new Validate ... review configuration steps (regex/enum rejection paths). The switch to passing --effort <level> to the Claude CLI and model_reasoning_effort="<level>" to Codex is not verifiable statically — if a pinned CLI/action version does not accept a given flag/value, all reviews for that reviewer would fail at runtime (generate fails → post is skipped). A single live run per reviewer would confirm the flags are accepted.

Reviewed commit 168ade24b88555803a3b407a204eaad6e39a8086. Workflow run