ci: address codex/copilot review on claude workflows

- claude.yml: gate @claude on author_association (OWNER/MEMBER/COLLABORATOR)
  so the write-scoped token and OAuth secret are never issued for an
  untrusted commenter on this public repo (defense-in-depth).
- claude-code-review.yml: skip fork PRs in the job condition
  (head.repo.full_name == github.repository) since forks get no secrets
  and would only fail noisily; fix the misleading token comment; pass
  additional_permissions: actions: read so actions: read is effective.
- hil SKILL.md: reword hostname guidance, use full test/hil/* paths, and
  show an explicit CONFIG= assignment so the local command is runnable.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

0 files changed, 0 insertions, 0 deletions