ci: migrate Claude workflows to claude-code-action v1

[stevenolen]

Bumps both Claude GitHub Actions workflows from claude-code-action@beta to @v1.0.110.

Changes

• .github/workflows/claude.yml and .github/workflows/claude-auto-review.yml: pinned to anthropics/claude-code-action@v1.0.110.
• Folded the v0 inputs (model, allowed_tools, custom_instructions) into the new claude_args (--model, --allowedTools, --append-system-prompt).
• Renamed direct_prompt -> prompt in the auto-review workflow.
• Dropped fallback_model (no v1 equivalent) and timeout_minutes (now a job-level timeout-minutes: 60).
• Added ANTHROPIC_DEFAULT_HAIKU_MODEL: us.anthropic.claude-haiku-4-5-20251001-v1:0 to each workflow's top-level env, replacing the implicit Claude 3.5 Haiku background model that hits Bedrock EOL on 2026-06-19.

Triggers, if: conditions, the actor permission check, checkout, and AWS credential steps are unchanged.

[stevenolen]

@claude review

[claude]

Claude finished @stevenolen's task —— View job

---

Review of PR #140

• Read changed workflow files
• Provide review feedback

---

LGTM. The migration from @beta to @v1.0.110 is clean and the input mappings are correct.

A few observations:

1. --append-system-prompt quoting (.github/workflows/claude.yml): The multi-sentence value is on a single line with no shell escaping. If any sentence ever contains a double-quote character, claude_args parsing could break. This is fine as-is but worth being aware of for future edits.

2. No --fallback-model: The PR description notes there's no v1 equivalent, so dropping it makes sense. Just confirming there's no degraded behavior if Opus quota is hit — the ANTHROPIC_DEFAULT_HAIKU_MODEL env var covers the background/tool-use model but not a primary model fallback. Acceptable tradeoff given the EOL deadline.

3. Pin version: Pinning to @v1.0.110 is more reproducible than @beta, which is good. Consider whether you want to track a major tag like @v1 in the future for automatic patches, or stay fully pinned for stability. Both are reasonable choices.

4. auto-review permissions block: The auto-review job has pull-requests: read — this is sufficient for reading the diff and creating reviews via the MCP tools (which use the app token), so that's correct.

No blocking issues. Ship it.

---