ci: skip Claude review on fork PRs instead of failing

[duanyiqun]

Problem

The label-gated claude-review job fails whenever the claude-review label is applied to a fork PR (e.g. #27 from `wsl2000`'s fork). GitHub deliberately withholds secrets and the OIDC token from fork-originated `pull_request` events, so the action receives an empty `CLAUDE_CODE_OAUTH_TOKEN` and errors with:

Unable to get ACTIONS_ID_TOKEN_REQUEST_URL
Could not fetch an OIDC token. Did you remember to add `id-token: write`...

Same-repo PRs (#23–26) review fine — only forks break.

Fix

Guard the job with a same-repo condition so labeling a fork PR is a clean no-op (skipped, neutral) rather than a guaranteed red failure:

if: >-
  github.event.label.name == 'claude-review' &&
  github.event.pull_request.head.repo.full_name == github.repository

• ✅ Same-repo PR + claude-review label → review runs as before
• ✅ Fork PR + claude-review label → job skipped, no red X
• 🔒 No security change (does not switch to pull_request_target)

Fork PRs can still be reviewed by pushing the branch to the main repo (collaborators have push access) and labeling there.

🤖 Generated with Claude Code