Adds an open-source version of the @claude GitHub workflow used in posit-dev/connect. Mentioning @claude in an issue, issue comment, PR review, or review comment runs anthropics/claude-code-action to triage, research, implement changes, and open pull requests.

This is a developer-tooling change with no user-facing impact, so there is no associated issue or NEWS entry.

Adaptations from the connect version

• Author gating: connect is a private repo, so anyone commenting @claude is a team member. This repo is public, so the job only runs when the author association is OWNER, MEMBER, or COLLABORATOR. Everyone else's mention is a no-op. If teammates with private org membership report NONE here, we may need to switch to an explicit team check.
• GitHub-hosted runners (ubuntu-latest) instead of posit-ubuntu-* self-hosted runners.
• No plugin marketplace: the doc-reviewer plugin and private posit-dev/claude-plugins marketplace (and the git URL token rewriting that supports them) are connect-specific and dropped.
• No toolchain setup: connect installs just and logs into GHCR so Claude can run tests. A full RStudio build is not feasible in a 30-minute GH-hosted job, so the prompt instead tells Claude not to attempt full builds.
• Dropped the pull_request self-test trigger: on a public repo it would match fork PRs.
• Prompt localized to this repo's conventions: follow .claude/CLAUDE.md, milestone from version/RELEASE, existing labels only, reviewer/assignee from the triggering actor.

Retained from connect: GitHub App token minting, Bedrock via AWS OIDC (no raw API key), role session name sanitization, claude/<number>-<slug>- branch prefix, progress tracking, opus with haiku fallback, and the locked --allowedTools list.

Setup required before merge

The GitHub App side needs no provisioning. The WORKBENCH_IDE_RELEASE_* org
secrets are already shared with this repo, and the app is already installed here
and writing to it -- it opens the version-bump PRs, and rstudio-pro's
ide-issue-state-sync workflow mints a token scoped to this repo for issue
writes. So the workflow now uses those secrets directly. The one permission that
could not be confirmed against an existing caller is actions: read, so it is
not requested; create-github-app-token returns 422 when the requested set
exceeds the installation's grants. If the app does hold it, restoring
permission-actions: read plus additional_permissions: "actions: read" gives
Claude access to CI logs.

That leaves one secret an admin needs to add:

• AWS_CLAUDE_ROLE_ARN -- the Bedrock OIDC role. rstudio-pro has a secret of
  the same name; the role's trust policy also has to allow this repo. Region
  is assumed us-east-2, matching connect.

Until it exists, merging this is safe but inert: gated runs would start and fail
at the assume-role step.

Follow-up (phase 2)

A later PR can teach the workflow to run the front half of the pylon pipeline (refine/research/plan) on request and publish the artifacts to rstudio/rstudio-pro-plans under plans/rstudio/<number>-<slug>/ via a stage PR, matching the existing pwb-dev layout. That needs the App token to span both repos and a decision on whether plans for public OS issues belong in the private plans repo.