Add configurable Claude and OpenAI review ensemble

[pweiskircher]

Summary

• make reviewers configurable as claude, openai, or claude,openai
• require Claude, Codex, and the optional synthesizer to emit one shared JSON schema
• run two selected reviewers concurrently after one checkout
• synthesize multiple review documents with a configurable provider/model into that same schema
• pass the final document through one filtering pipeline and one provider-neutral GitHub review publisher
• retain raw claude.json, openai.json, and synthesized.json documents as private workflow artifacts

Compatibility

Claude remains the default. A caller that only supplies claude-api-key follows the existing Claude path without installing Codex, requiring an OpenAI key, or invoking synthesis. Single-reviewer JSON is passed through unchanged before the existing filtering/enrichment stage.

The OpenAI key is only required when OpenAI is selected. If multiple selected reviewers or the synthesizer fail, the action fails instead of posting a partial public review.

Security boundaries

• reviewer subprocesses do not receive the GitHub token
• Claude does not receive the OpenAI credential
• Codex does not receive the Anthropic credential
• Codex uses a single-run CODEX_API_KEY, an ephemeral session, ignored user/repository rules, and a read-only sandbox
• these are process-level controls on the same Actions runner, not VM isolation

Testing

• pytest claudecode -q — 234 passed
• bun test comment-pr-findings.bun.test.js — 26 passed
• bash scripts/test-determine-claudecode-enablement.sh — 28 passed
• bash scripts/test-detect-trigger-type.sh — 16 passed
• git diff --check
• action.yml YAML parse
• autoreview: accepted and fixed the unset PYTHONPATH regression; no other accepted findings

Rollout note

No OpenAI secret is needed to merge this. The default remains Claude-only. Enabling OpenAI later is an explicit caller configuration and secret-management decision.