PR #118 merged: fix(ci): let claude-review post comments, unpin legacy model

Same two silent CI failures just fixed in claudavel (StuMason/claudavel#58):

1. Reviews could never post — claude-code-review.yml grants pull-requests: read / issues: read but the prompt instructs gh pr comment; a read token can't comment, so every run passed green with no review posted. Bumped to write.
2. Legacy model pin — claude.yml pinned claude-opus-4-5; dropped so the action tracks its current default and can't rot into a retired ID (as happened in claudavel with sonnet-4).

Workflow-only change, no code touched. types: [opened] left as-is.