Fix claude-code-review.yml trust gate: check PR author, not head repo owner

[jnasbyupgrade]

The claude-review job's trust gate checked:

if: >-
  github.event.pull_request.draft == false &&
  github.event.pull_request.head.repo.owner.login == 'jnasbyupgrade'

head.repo.owner.login only identifies who owns the fork for fork-headed
PRs. For an upstream-branch-headed PR (base and head both live in this
repo -- required by gh stack, and also just what you get from gh pr create without a fork), head.repo.owner.login is always this repo's own
org, never the actual PR author -- so the gate silently skipped review on
every such PR regardless of who opened it.

Fix: check the PR author instead:

if: >-
  github.event.pull_request.draft == false &&
  github.event.pull_request.user.login == 'jnasbyupgrade'

user.login can't be spoofed by a third party any more than head repo owner
can, and it's the more direct question for this gate's actual purpose:
trusting the person asking for review, not the repository their branch
happens to live in. Works for both fork-headed and upstream-branch-headed
PRs.

Also updated the adjacent SECURITY-CRITICAL comment (which explains why this
check is the only thing making allow-unsafe-pr-checkout: true safe below)
to describe the author check instead of the now-removed owner check.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 429a92bd-fef6-47ea-9b4a-5c7f2584973e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}