fix(ci): authenticate origin before the Claude action's branch fetch, and count its github-actions findings

[theCodeDrift]

Two fixes for running claude-code-action with github_token, both found while vendoring the review workflows into taskless/marketing (taskless/marketing#73).

Review and focus workflows fail on private repos

When track_progress: true is set, the action runs in tag mode, which runs git fetch origin <headRefName> before configureGitAuth puts the token into the origin URL. Our checkout uses persist-credentials: false, so that fetch has no credentials. It works here only because this repo is public.

Both workflows now have a step right before the action that sets the origin URL to the same value the action writes moments later, using the same token. The comment on the step explains why persist-credentials: true is not a safe alternative: checkout v7 stores its credential in an includeIf file under RUNNER_TEMP, which the action doesn't remove and the Read(.git/**) deny rule doesn't cover.

iterate-pr treats Claude findings as bot noise

With github_token, Claude's comments are posted as github-actions (GraphQL) or github-actions[bot] (REST). Both match INFO_BOT_PATTERNS, so every finding was put in bot and the script reported needs_attention: 0. Because that login is shared with informational bots, fetch_pr_feedback.cjs now decides by content:

• Inline review threads from github-actions count as review feedback.
• Top-level comments from github-actions count only when they carry a claude-code-action marker (Claude finished @…, an in-progress placeholder, or a [View job](…/actions/runs/N) link). All other github-actions comments stay in bot.
• A placeholder posted as github-actions now holds review_in_progress open.

Tests cover both login spellings, inline threads, finished summaries, both placeholder states, and an ordinary github-actions comment that must stay in bot.

There's no changeset because neither change ships in a published package.

Fixes #512
Fixes #516