Review PRs with Opus 5.5

[bbertucc]

The PR reviewer's default model moves from Opus 5 to Opus 5.5: newer, and 20% cheaper at list price. The shared IAM role equalify-iris-gha-bedrock-review got a new inline policy, bedrock-invoke-opus5-5, allowing the Opus 5.5 inference profile and its foundation models; the Opus 5 policy is unchanged, so equalify-iris is unaffected. This PR's own review runs on Opus 5.5 and so tests the role.

🤖 Generated with Claude Code

[github-actions]

This PR changes code-review.yml — its review runs on the fallback token

The review still runs, but posts as github-actions[bot] rather than claude[bot].

Read the workflow diff yourself anyway. The reviewer is reviewing the file that
decides whether anything gets reviewed. Check whether it lets PR-authored code run
with secrets, widens permissions:, interpolates attacker-controlled
${{ github.event.* }} into a run: block, or weakens Verify a review was posted.

Run: https://github.com/EqualifyEverything/equalify-iris-pdf/actions/runs/37211306164

[github-actions]

All checks pass (actionlint, npm ci, typecheck, unit; shellcheck skipped, no scripts). The workflow change is one line: the default for --model at .github/workflows/code-review.yml:410. It changes no trigger, permission, secret, step or if:. This review ran on us.anthropic.claude-opus-5-5, so the role's new Bedrock policy works.

Non-blocking notes

• .github/workflows/code-review.yml:410: vars.BEDROCK_REVIEW_MODEL || 'us.anthropic.claude-opus-5-5'. If the repository variable BEDROCK_REVIEW_MODEL is set, it overrides this default. Docs line 70 now says the reviewer is Opus 5.5, which holds only while that variable is unset. I could not check the variable from here.
• docs/models.md:72: the $1.15 figure is an estimate scaled from Opus 5's price. Replace it with measured runs once there are some.

Accessibility impact: None. Only CI's review model and its docs change; no code that builds the PDF is touched.