* workflows: restrict Claude triggers to collaborators/members/owners and fix fork PR reviews
- claude.yml: gate by author_association in [COLLABORATOR, MEMBER, OWNER]
- claude-code-review.yml: use pull_request_target, add pull-requests: write and id-token: write to enable OIDC + commenting on forks
* fix(workflows): remove 'reopened' and 'assigned' types from triggers