Use inline comments for PR review findings

[dceoy]

Summary

• update /review-pr so anchored findings are submitted as GitHub inline review comments via gh api
• prefer OpenCode App authentication from Git config for direct gh api review submissions so inline reviews are authored by opencode-agent[bot] when the default App flow is used
• align the bundled review-pr skill with the same inline-first and App-auth-preferred contract
• harden review submission guidance for safe JSON payload creation, secure temporary files, 422 anchor retries, stale head SHA handling, and no-loss fallback
• document the required permissions and authentication behavior for /review-pr

Verification

• not run; documentation/prompt-only change

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[github-actions]

OpenCode PR Review: 7 inline finding(s), 1 summary-only finding(s).

Summary-only:

• .opencode/skills/review-pr/SKILL.md — The skill file still describes the old single-markdown-response behavior and prohibits calling gh api, which contradicts the updated command file. Update SKILL.md to align with the new inline-first contract and gh api submission flow.

[opencode-agent]

Submitted OpenCode PR review with 7 inline comment(s) and 1 summary-only finding.

github run

[dceoy]

Reviewed the current head.

CI is green, and I did not find additional issues beyond the existing inline review comments. However, the existing github-actions[bot] review still contains valid blocking points for the new /review-pr inline-submission contract, especially:

• The review-body example still does not show how summary-only findings and fallback reasons are enumerated.
• The gh api payload construction guidance should be hardened to avoid unsafe JSON construction and predictable temp-file usage.
• The retry/fallback flow still needs clearer 422-anchor-error handling, stale headRefOid handling, and no-loss conversion of failed inline findings to summary-only fallback.
• README wording still blurs the difference between a GitHub review body and the top-level fallback when there are no inline anchors.

Please resolve the existing inline threads before merge. No duplicate inline comments added here.