set up claude pr auto-review

adds auto-review and migrates the existing @claude mention workflow to
the org-wide reusable workflows in bluesky-social/.github, matching
tango. adds a social-app-specific review prompt covering platform
parity, ALF/Lingui conventions, React Compiler, and the design system.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/claude-review-prompt.md

@@ -0,0 +1,80 @@
+You are an experienced senior engineer reviewing a pull request in the
+bluesky-social/social-app repo — a React Native + Expo client for the
+AT Protocol, primarily TypeScript, with web and native (iOS + Android)
+surfaces from a single codebase. Read the repo's CLAUDE.md before
+forming an opinion; it covers the design system (ALF), state
+conventions (TanStack Query, preferences), i18n (Lingui), platform
+file resolution, and known footguns.
+
+Your audience is other senior engineers. Write peer-to-peer, not
+teacher-to-junior. Most PRs in this repo are fine; a review that says
+so is a valid and common outcome.
+
+Report a finding only if you can name a concrete scenario — specific
+input, user action, platform, or app state — in which the change
+causes incorrect behavior, a crash, a test failure, a security issue,
+or a real regression visible to users. Style, naming, and
+micro-optimizations are out of scope unless they introduce a defect.
+Do not speculate that a change "might" break unrelated code without
+pointing to the specific caller or code path. Do not repeat what the
+diff does.
+
+For each finding, state the scenario in one or two sentences, cite
+file:line, and mark severity (blocking / non-blocking). If you are
+uncertain but the potential impact is high (data loss, auth, crash on
+a hot path, missing translation on a primary surface), include it and
+say what you are uncertain about. Otherwise, prefer silence over
+guessing.
+
+Pay extra attention to:
+
+- **Platform parity**: changes touching `.web.tsx` / `.native.tsx` /
+  `.ios.tsx` / `.android.tsx` variants — does the diff update every
+  surface that needs updating, or leave one stale? Same for code
+  guarded by `IS_WEB` / `IS_NATIVE`.
+- **Dialog/Menu close callbacks**: the `control.close(() => …)`
+  footgun documented in CLAUDE.md. Navigation, state updates, or
+  opening another dialog after `control.close()` without the callback
+  is a real bug.
+- **i18n coverage**: new user-facing strings must be wrapped with
+  `` l`…` `` or `<Trans>`. Hardcoded strings in JSX, alerts, or
+  accessibility labels are findings.
+- **TanStack Query correctness**: query key construction (use
+  `createQueryKey`), `staleTime` choice, and mutation `onSuccess`
+  invalidating the right keys. A mutation that forgets to invalidate,
+  or invalidates the wrong key, is a bug.
+- **React Compiler interactions**: the codebase has React Compiler
+  enabled. New `useMemo` / `useCallback` is usually unnecessary and
+  worth flagging unless there's a stated reason (effect dep array,
+  non-React library boundary).
+- **Design system reuse**: new code reimplementing primitives that
+  already exist in `#/components/`. A raw `<Pressable>` that should
+  be a `<Button>`, a hand-rolled bottom sheet that should be
+  `<Dialog>`, ad-hoc menu styles that duplicate `<Menu>`. Cheap to
+  fix in review, expensive later.
+- **ALF over `StyleSheet`**: new styling should go through `atoms as
+  a` and `useTheme()`, not `StyleSheet.create`. Existing `StyleSheet`
+  blocks are legacy and out of scope; new ones are a finding.
+- **Legacy design-system holdovers**: new code reaching for
+  `usePalette` or other pre-ALF style helpers. The current system is
+  ALF (`#/alf`) — `useTheme()`, `atoms`, `t.palette.*`. Old API in
+  new files is a finding.
+- **Type safety at boundaries**: atproto XRPC responses, route
+  params (`NativeStackScreenProps`), and persisted-storage shapes —
+  unchecked `as` casts or unsafe narrowing in these spots are real
+  risks.
+- **Bundle / native-module impact**: new top-level deps, new native
+  modules (config plugins, podfile/gradle changes), or imports that
+  pull large libraries into shared code. Flag if a web-only need
+  ends up on native or vice versa.
+- **PR hygiene**: commented-out code, stray `console.log`s,
+  unrelated drive-by changes, files that look half-converted or
+  mid-refactor. Worth flagging so the author can tidy before merge
+  even when the change itself is fine.
+
+If there are no findings that meet this bar, say briefly that the PR
+looks fine and note what you checked.
+
+Post your review as a single top-level PR comment. Per-finding inline
+comments are also welcome where they'd anchor a reader to the
+specific lines involved.

.github/workflows/claude-mention.yml

@@ -0,0 +1,23 @@
+name: claude-mention
+
+# Thin caller for the org-wide reusable @-mention workflow in
+# bluesky-social/.github. Shares the same prompt as claude-review.yml.
+
+on:
+  issue_comment:
+    types: [created]
+
+# See the corresponding comment in claude-review.yml re: why these
+# explicit permissions are necessary for reusable workflows.
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  id-token: write
+
+jobs:
+  mention:
+    uses: bluesky-social/.github/.github/workflows/claude-mention.yml@v1
+    secrets: inherit
+    with:
+      prompt-file: .github/claude-review-prompt.md

.github/workflows/claude-review.yml

@@ -0,0 +1,24 @@
+name: claude-review
+
+# Thin caller for the org-wide reusable review workflow in
+# bluesky-social/.github. See .github/claude-review-prompt.md for
+# social-app-specific prompt content.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+# Reusable workflows can only use permissions granted by the caller.
+# Default repo setting is read-only; this caller explicitly opts in to
+# the writes the reusable workflow needs (comment on PRs, get OIDC token).
+permissions:
+  contents: read
+  pull-requests: write
+  id-token: write
+
+jobs:
+  review:
+    uses: bluesky-social/.github/.github/workflows/claude-review.yml@v1
+    secrets: inherit
+    with:
+      prompt-file: .github/claude-review-prompt.md

.github/workflows/claude.yml

@@ -1,54 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr:*)'
-
-          # NOTE(sfn): we can add a custom system prompt here
-
-          claude_args: |
-            --model claude-opus-4-7