Let Claude compose and send readable Feishu CI cards

[RyanLee-Dev]

CI notices currently flatten a long report into a fixed card and obscure the PR, actual changes, compliance conclusion and failed nodes. Replace that design with natural-language instructions for Claude to generate a readable Feishu Card 2.0 and POST it itself through Bash/Node.

The prompt prioritizes the PR link, 1–3 behavior-change bullets, evidence-backed compliance findings and failed job/step links. It omits routine skips and successful-job inventories, requires short mobile-readable content, and treats missing context as uncertainty rather than a violation. Collection now supplies associated PR metadata and bounded source context at the recorded revision.

The workflow has no independent sender or scripted fallback. Claude reads the webhook/signing secret from its step environment, signs if configured, sends the card, and confirms the response. A small final check fails the workflow unless Claude returns sent=true. The prompt prohibits retrying ambiguous requests. Existing bot and non-write actor allowances are preserved so completed external-contributor CI still receives a notification. Source remains untrusted data in the prompt, the checkout is trusted, the GitHub token remains read-only, and the only enabled tool is Bash with Node permission for delivery. All implementation remains in ci-review.yml.

Validation: make check-ci check-docs check-names, actionlint 1.7.12 and whitespace checks passed. Inline checks covered PR association, immutable comparison, source context, failure filtering and delivery-result validation. Tool arguments were verified with the pinned Action's actual parser. Live model generation and Feishu posting remain unverified and require a configured workflow run.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}