Follow-up: wire GitHub MCP tools into claude.yml's claude_args allowedTools

[claude]

Loose end from #182 (merged 2026-07-05, 24c17be).

#182 added several mcp__github__* entries to .claude/settings.json's permissions.allow (pull_request_read, get_job_logs, create_pull_request, update_pull_request, resolve_review_thread, add_reply_to_pull_request_comment, add_issue_comment, issue_write, subscribe_pr_activity, search_issues, list_pull_requests). A review comment (discussion) pointed out this doesn't actually enable them for the @claude mention-triggered sessions in .github/workflows/claude.yml:

the pinned anthropics/claude-code-action@v1.0.163 builds its tag-mode MCP config from parseAllowedTools(process.env.CLAUDE_ARGS) and only spreads those mcp__github_... entries into tagModeTools... these newly allowlisted mcp__github__... tools remain unavailable in @claude runs unless the same entries are also supplied via --allowedTools.

No reply and no follow-up commit before merge. Current main (.github/workflows/claude.yml:88) still has:

--allowedTools "Bash(./gradlew:*),Bash(git status:*),Bash(git diff:*),Bash(git log:*),Bash(javap:*)"

with no mcp__github__* entries, so @claude PR/issue-comment sessions still can't use the GitHub MCP tools #182 intended to grant them.

Fix: add the same mcp__github__* tool names to claude_args's --allowedTools in .github/workflows/claude.yml (or otherwise confirm/document that tag-mode sessions pick up settings.json permissions and this analysis is wrong).