ci: fix harness drift — Claude review, L4 trigger, Go 1.25.12

.github/workflows/claude-code-review.yml

@@ -19,10 +19,14 @@ jobs:
     #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
 
     runs-on: ubuntu-latest
+    # write on pull-requests + issues is required for the action to POST its
+    # review back to the PR: inline review comments use the pull-requests API,
+    # the summary comment uses the issues API. With read-only the review runs
+    # but silently posts nothing ("No buffered inline comments").
     permissions:
       contents: read
-      pull-requests: read
-      issues: read
+      pull-requests: write
+      issues: write
       id-token: write
 
     steps:

.github/workflows/vm-e2e-spike.yml

@@ -3,6 +3,8 @@ name: vm-e2e-spike
 on:
   push:
     branches: ["test/vm-e2e-speed"]
+  pull_request:
+    branches: [main, master]
   workflow_dispatch:
 
 jobs:

go.mod

@@ -1,6 +1,6 @@
 module github.com/openbootdotdev/openboot
 
-go 1.25.11
+go 1.25.12
 
 require (
 	github.com/charmbracelet/bubbles v0.20.0