docs(ci): cross-reference the two verify steps, and record why they are not shared

A local composite action loads from the checkout, which in both workflows is
the PR's contributor-authored tree, so sharing the step that way would run
PR-controlled code with the job's write token. Each copy now names the other
so a fix to the detection logic reaches both.

Author: theCodeDrift

.github/workflows/claude-code-focus-on-demand.yml

@@ -250,10 +250,13 @@ jobs:
       # `num_turns`, why bodies go through `@json`, why the run id is anchored
       # on its right, and why only bot comments count.
       #
-      # This is INLINE rather than a shared script on purpose. On issue_comment
-      # the workflow file comes from the default branch, but the checkout above
-      # is the PR's contributor-authored tree. A script run from that tree would
-      # execute whatever the PR changed it to, holding this job's write token.
+      # This is INLINE rather than a shared script or a local composite action
+      # on purpose. On issue_comment the workflow file comes from the default
+      # branch, but the checkout above is the PR's contributor-authored tree,
+      # and both a script and `uses: ./.github/actions/...` load from it. Either
+      # would run whatever the PR changed it to, holding this job's write token.
+      # A fix to the detection logic belongs in both copies; the review
+      # workflow's step points back here.
       #
       # Metrics are diagnostic only: the run fails on no posted summary or an
       # action-reported error, and warns on permission denials, naming the

.github/workflows/claude-code-review-on-demand.yml

@@ -405,6 +405,13 @@ jobs:
       # THAT MARKER IS A CONTRACT WITH THE PROMPT. If the review-mode
       # instruction is ever reworded or dropped, change it here in the same
       # commit, or this step starts failing every run.
+      #
+      # A COPY OF THIS STEP lives in claude-code-focus-on-demand.yml, differing
+      # in its marker (`Focus areas:`). A fix to the detection logic here
+      # belongs in both. It is copied rather than shared because a local
+      # composite action (`uses: ./.github/actions/...`) loads from the
+      # checkout, which is the PR's contributor-authored tree, and would run
+      # with this job's write token.
       - name: Verify the review actually ran
         if: always()
         env: