ci(review): add review-claim label gate and modernize action pins

[code-yeongyu]

What

Installs the review-claim label system and unifies the shared GitHub Action pins on their current majors.

The three labels

Label	Color	Meaning
will-review	fbca04	A reviewer claims the PR ("I will review this"). Blocks merge.
in-review	1d76db	The claimer is actively reviewing. Blocks merge.
stale-review	d93f0b	A claim sat 3+ days without the claimer's review; the sweep cleared the claim. Needs a (new) reviewer.

The labels already exist on the repository; this PR ships the automation and the documentation.

The merge gate

Review claim gate fails while will-review or in-review is present on the PR, and passes otherwise. It runs on pull_request_target for open / reopen / synchronize / ready_for_review / label / unlabel, so the status refreshes the moment a claim is applied or released. The job name is stable so it can be wired up as a required branch-protection context; that wiring is intentionally not part of this PR.

The automation jobs

Job	Trigger	Behavior
Review claim gate	pull_request_target	Fails while a claim label is present; green when there is none.
Register claimer as reviewer	claim label applied	Requests review from the labeler and clears stale-review. Skips bots and self-review by the PR author.
Release claim on claimer review	pull_request_review submitted	Removes a claim label only when the person who applied it submits approve / request-changes. Another reviewer's review leaves the claim intact.
Sweep stale review claims	cron 23 */6 * * * + manual	Removes claims idle 3+ days without the claimer's review and applies stale-review.

Claim ownership is resolved from the issue timeline (labeled events), so a claim can only be released by its own claimer.

Version bumps

Two competing actions/checkout pins and two competing actions/setup-node pins are collapsed onto one verified SHA each; the artifact actions leave the retiring v4 line. Every pin keeps the repository's full-commit-SHA style with a trailing version comment.

Action	Old pin	New pin	Tag
actions/checkout	df4cb1c0 (15x) + 3d3c42e5 (3x)	3d3c42e5aac5ba805825da76410c181273ba90b1	v7.0.1
actions/setup-node	48b55a01 (15x) + 82076278 (3x)	820762786026740c76f36085b0efc47a31fe5020	v7.0.0
actions/upload-artifact	ea165f8d (v4.6.2)	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	v7.0.1
actions/download-artifact	d3f86a10 (v4.3.0)	3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c	v8.0.1
oven-sh/setup-bun	4bc047ad (v2.0.1)	0c5077e51419868618aeaa5fe8019c62421857d6	v2.2.0
actions/github-script (new file)	—	3a2844b7e9c422d3c10d287c895573f7108da1b3	v9.0.0

Only uses: lines change in the bump commit — no runner labels, no unrelated actions, no reformatting.

Verification

• actionlint v1.7.10: exit 0, zero findings.
• node scripts/check-pr-changelog.mjs: PASS - changes.md coverage complete (4 production path(s) covered); no runtime source changes detected. The four upstream-owned workflows are covered in .github/changes.md with all four canonical sections, so no no-changelog label is required.
• The mandatory workflow-summary checker reports 7 pre-existing violations that are byte-identical on main; review-claims.yml itself writes a summary in every job (baseline 5/12 -> 6/13).

---

Summary by cubic

Adds a review-claim label system that blocks merges while a PR is claimed, and unifies the shared GitHub Action pins on current majors.

• will-review and in-review fail the Review claim gate job; applying one requests the labeler as reviewer and clears stale-review.
• A claim is removed only when the claimer submits an approve or request-changes review; another reviewer's review leaves it intact.
• A 6-hourly sweep moves claims idle 3+ days to stale-review, which signals the PR needs a new reviewer.
• The gate runs on pull_request_target so the status refreshes on label changes; branch protection must still be wired to the job separately.
• Workflows now pin actions/checkout v7.0.1, actions/setup-node v7.0.0, actions/upload-artifact v7.0.1, actions/download-artifact v8.0.1, and oven-sh/setup-bun v2.2.0 as single SHAs, collapsing the two competing checkout and setup-node pins.
• Only uses: lines change across the modified workflows.
• AGENTS.md documents the label rules and the no-merge-while-claimed rule.

^{Written for commit 65a1ed3. Summary will update on new commits.}