feat(pr-review-cli): run prior-findings.mjs and pass its note to the review lanes #950

Refs: melodic-software/claude-code-plugins#7777

Summary

claude-code-plugins#12011 adds plugins/review/lib/prior-findings.mjs and teaches /review:code-review and /review:security-review to read a PRIOR FINDINGS file, so a lane stops re-posting a finding on an open thread whose lines have not changed, and narrows to high severity after loop.review-rounds rounds. The skills only act when that file exists; nothing writes it yet.

Fix

In .github/workflows/pr-review-cli.yml, on both lanes (code and security):

• Add a no-model step before the compose step that runs node plugins/review/lib/prior-findings.mjs from the checked-out plugin, for the PR, the lane name and the current head, with GITHUB_TOKEN read-only. It reads the round cap (loop.review-rounds) from docs/conventions/pr-pipeline.yaml on the default branch, never the head.
• Write its output to the PRIOR FINDINGS file the skill reads and pass that path to the compose step.
• A failure of the step leaves the file absent, so the lane reviews as before (fail-open to today's behavior).

Verification

• A PR with an open lane thread on unchanged lines: the next round posts no repeat and one uncounted summary line.
• A PR past the round cap: the code lane posts only blocking findings, the security lane only CRITICAL and IMPORTANT.

Related

• feat(review): converge CI review lanes across rounds, trusting only the lane's own posts claude-code-plugins#7777 (rule 1 already ships here as incremental-review).