Two-step claude-review: separate gate + comment

Fixes the claude-review --json-schema … did not return structured_output failure. Root cause (confirmed on real Dependabot runs): track_progress: true and --json-schema are mutually exclusive execution modes in claude-code-action — set together (the prior config) the run returns no structured output and fails, and re-runs can't escape it.

This splits the work into two claude-code-action calls, each in a supported mode:

• Step 1 — gate: --json-schema {recommendation, riskLevel}, no track_progress → the machine-readable PASS/FAIL verdict the summary step gates on.
• Step 2 — comment: track_progress: true, no --json-schema → posts the rich human-readable review comment.

The summary step gates on step 1's structured output (non-PASS → red check) and no longer posts a comment. Defense-in-depth: continue-on-error on the gate + an advisory guard if structured output is ever missing.

Cost: two Claude calls per reviewed Dependabot PR (majors + uncertain-compat only; patches/minors with good compat auto-merge and skip review).

Validation

claude-code-action self-skips on any PR that edits a workflow file, so this can only be validated on a real Dependabot PR that doesn't touch workflows — not via a workflow-pin test branch (that self-skips and looks green while doing nothing). I'm validating on a live @dependabot recreate run before re-pinning the 13 callers.

🤖 Generated with Claude Code