ci: log GITHUB_TOKEN api-calls from the synced review callers #899

Problem

In melodic-software/claude-code-plugins, GITHUB_TOKEN's rate-limit header read 3,804 calls used for 2026-10-28 16:52-17:52Z. The per-job api-calls github-token=N notices accounted for only about 932 of them. The review callers this repository manages, pr-review-hosted.yml and pr-review-security-hosted.yml (listed under pull_request.paths in the consumer's pr-check-managed-files-hosted.yml), log no API-call counts, so their GITHUB_TOKEN spend can't be measured. Their resolve-model and kill-switch jobs and the reusable review workflows they call emit no api-calls notice. melodic-software/claude-code-plugins#10710 adds the notice to that repository's own jobs, but it can't edit these synced files.

Fix

Add the log-api-budget step, the same one the consumer's other jobs use (.github/actions/log-api-budget, which emits api-calls github-token=N), to every job in the two review callers and their reusable workflows that holds GITHUB_TOKEN. A job with no reading prints github-token=0 (claude-code-plugins#10710).

Acceptance

• Each job in the synced review callers that runs on a runner and holds GITHUB_TOKEN emits one api-calls github-token=N notice.
• No permission, secret or trigger changes.

Related

• ci: log GITHUB_TOKEN api-calls from the jobs that logged none claude-code-plugins#10710
• ci: log GITHUB_TOKEN api-calls from ci-status, post-merge-dispatch and intake-reenter claude-code-plugins#10551, #10587 (same pattern for other jobs)