refactor(ci): split the issue analyst out and brief the review job from a file

The issue analyst moves verbatim from claude-bot.yml into its own
claude-issue-analyst.yml, so claude-bot.yml now holds only the pull-request
side: review, @claude mentions and conflict resolution.

The review job's briefing was a single 2,600-character quoted string inside
claude_args, unreadable and unreviewable. It now lives in
.github/claude/review-job.md, assembled at run time with a "This run"
section that hands the reviewer the pinned head SHA, the pull request and
the exact check-runs command, and reaches the CLI through
--append-system-prompt-file. The agent-mode action sets no system-prompt
append of its own, so the file flag cannot collide with one.

Findings no longer carry the fix: REVIEW.md and the brief both forbid
suggestion blocks, patches and replacement snippets, overriding the
code-review skill's --comment step, which attaches a committable suggestion
to any small fix. A finding states what is wrong, where, what triggers it
and what breaks; the maintainer decides the change.

REVIEW.md

@@ -145,3 +145,12 @@ and what it turned out to be, plus the head SHA and the size of the diff it
 covers. Say which claims could not be verified and why, including a check
 this environment blocked. Keep that coverage list under ten lines; it is
 evidence, not a retelling of the pull request.
+
+## A finding is a report, not a patch
+
+A finding says what is wrong, where (`file:line`), what triggers it and what
+breaks. It never carries the fix: no `suggestion` block, no patch, no
+replacement snippet, no rewritten function, no "suggested fix" section — in
+the summary and in an inline comment alike. One clause naming where the fix
+belongs is the most it may add. The maintainer decides the change; a review
+that writes it out puts unreviewed code one click from the branch.