on: issues [opened, labeled], gated to the `claude` label (only collaborators
can label). Runs on kasse's podman runner: builtin:checkout + Claude Code
installed in the ephemeral container, with a file-only tool allowlist
(Read/Edit/Write/Grep/Glob, acceptEdits — no Bash, no network) so an untrusted
issue body can at worst propose a bad edit caught in PR review. Opens a PR
closing the issue if files changed, otherwise comments Claude's reply.
Needs repo Actions secret CLAUDE_CODE_OAUTH_TOKEN; uses the built-in token for
the branch push / PR / comment.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
