ci: add AI code review caller workflow

[yousefdebaz-fivexlio]

Adopts the shared AI code review workflow from fivexl/shared-workflows.

What

Adds .github/workflows/ai-review.yml, copied as-is from fivexl/shared-workflows/workflow-templates/ai-review-caller.yml. It calls the reusable fivexl/shared-workflows/.github/workflows/ai-code-review.yml@main workflow on pull_request events (opened/synchronize/reopened/ready_for_review).

Why

Gives every future same-repo PR against magic-button an automated AI review pass (business logic / security / performance dimensions), posted as inline comments + a summary. Never approves or blocks - purely advisory.

Requirements

Assumes the org-level secrets APP_ID, APP_PRIVATE_KEY, and DEVELOPMENT_ACCOUNT_ROLE_ARN already exist (used by other FivexL repos adopting this same workflow). No new secrets added here.

Notes

• The jobs.review.if guard skips draft PRs and fork PRs (head.repo.full_name != base repo) - by design, since fork PRs cannot be trusted with the GitHub App token or Bedrock OIDC role. Fork PRs need a maintainer to re-push the commit to a same-repo branch first.
• No functional code changed; workflow-only addition.

[fivexl-reviewer]

AI Code Review Summary

• Findings posted: 0 inline, 0 thread replies
• Threads marked resolved: 0

Additional observations

• Additional considerations: (1) Missing secrets would cause silent runtime failure without clear error messaging—consider a secrets existence check or documentation note. (2) cancel-in-progress may cancel mid-review, leaving orphaned comments—this is acceptable for rapid iteration but worth awareness. (3) Fork PRs silently skip review with no contributor feedback.
• .github/workflows/ai-review.yml:42 — Reusable workflow uses a mutable branch reference (@main). An attacker with write access to shared-workflows could modify it to exfiltrate secrets (APP_PRIVATE_KEY, APP_ID). Use a pinned SHA for immutable, auditable references.
• .github/workflows/ai-review.yml:55 — APP_PRIVATE_KEY (a highly sensitive GitHub App credential) is passed to a reusable workflow from an external repository. This key can impersonate the GitHub App. Ensure the reusable workflow is thoroughly audited, or consider OIDC token exchange patterns instead of passing raw private keys.

Note for AI coding agents: detailed findings are posted as inline review comments on the diff — read the unresolved review threads (e.g. gh api repos/<owner>/<repo>/pulls/<pr>/comments) before making changes; this summary is only an overview.

This summary was automatically generated by the AI code review workflow.