chore: add Pullfrog workflow file

[pullfrog]

This PR adds the .github/workflows/pullfrog.yml workflow file to enable Pullfrog agent runs in this repository.

Once merged, return to the Pullfrog console and click Verify workflow to finish setup.

[github-actions]

Automated review unavailable (the review step failed, or the context it needs could not be gathered). Please review manually.

[zfarrell]

Two changes on top of the console-generated file (114fc20), both explained in the header comment:

• Dropped the env: block. It mapped ANTHROPIC_API_KEY — the org secret gating the production reviewer — into a third-party agent, and would have let auto-select run this trial on Claude rather than OpenAI. The other nine name secrets that don't exist, and a workflow env: value wins over a Pullfrog-stored key, so an empty mapping would have overridden the console's OPENAI_API_KEY. The key goes in the Pullfrog console instead.
• Review-only hardening: push: disabled, shell: restricted, progress_comments: disabled, timeout: 20m, and actions/checkout pinned to the exact version this repo pins everywhere else.

Merge order matters: #38 has to land first. It keeps Pullfrog's comments out of the Claude reviewer's prompt — without it the two reviewers read each other and the comparison isn't independent.

[claude]

nit: timeout: 20m is an input to the third-party action, so the cap is self-enforced — the comparison to the reviewer's 15 minutes isn't apples to apples, since that one is timeout-minutes: 15 on the job (claude-pr-review.yml:44) and GitHub enforces it. If pullfrog/pullfrog hangs anywhere outside the agent's own clock — the npm bootstrap that fetches the agent, or the post-run cleanup step — nothing stops the job before GitHub's 6-hour default. A job-level backstop somewhat above the action's own cap would make the 20m real:

  pullfrog:
    runs-on: ubuntu-latest
    timeout-minutes: 25

(not blocking) (not blocking)

[claude]

nit: "nothing here grants it the ability to comment, review, or push" is true of this job's GITHUB_TOKEN and not true of the job overall — id-token: write is precisely what lets the action trade an OIDC token for a Pullfrog App installation token, and that token's scopes live in Pullfrog's App config, not in this file. So the capability the comment says is absent is delegated rather than withheld, and it's unreviewable from here.

That also bounds what push: disabled on line 65 buys: it's an input to the same mutable @v0 tag, so it constrains a cooperating action, not a compromised one. Given that tests.yml:23-25 refuses to take even actionlint as a third-party action because this repo's workflows gate every merge in the org, the honest version of this comment is that the trial accepts a mutable third-party tag with OIDC on the vendor's advice — not that the job holds nothing dangerous. Worth saying plainly, since the next reader will take this block at its word.

(not blocking)

[claude]

super nit: "This repository pins every action to an exact patch version" isn't quite so — anthropics/claude-code-action@v1 (claude-pr-review.yml:214) floats on a major tag today. That doesn't weaken the case for pinning actions/checkout here, but it does mean pullfrog/pullfrog@v0 isn't the sole exception, and a reader who checks the claim will find it doesn't hold. (not blocking)