update readme

Author: leonidgrishenkov

README.md

@@ -14,7 +14,7 @@ workflows are self-contained in this repository under `.github/workflows/`.
 | Trigger                          | Workflow      | What runs                                                                                                                    | Purpose                          |
 | -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------- | -------------------------------- |
 | Push to any branch except `main` | `feature.yml` | `hadolint` Dockerfile lint, Trivy config scan, `actionlint`, GitGuardian secret scan                                        | Fast feedback during development |
-| PR into `main`                   | `pr.yml`      | Build amd64 image, Trivy scan (HIGH/CRITICAL), SARIF upload, smoke test                                                      | Gate — must pass before merge    |
+| PR into `main`                   | `pr.yml`      | Build amd64 image, Trivy scan (HIGH/CRITICAL), SARIF upload, smoke test, Claude code review (on open)                       | Gate — must pass before merge    |
 | Push tag `*.*`                   | `release.yml` | Verify tag is on `main`, build multi-arch (`linux/amd64`, `linux/arm64`), push to YC CR, SBOM + SLSA provenance, cosign sign | Release                          |
 
 ### Design Goals
@@ -37,13 +37,25 @@ workflows are self-contained in this repository under `.github/workflows/`.
   of `main`, preventing releases from arbitrary branches.
 - **Image Signing** — every release image is signed with **cosign** using keyless OIDC via GitHub Actions.
 
+### Claude Code Review
+
+- **`claude-review`** (part of `pr.yml`) — runs once, when a PR into `main` is **opened**, and posts an automated
+  code review (top-level + inline comments via `gh pr comment` / inline PR comments) using
+  [`anthropics/claude-code-action`](https://github.com/anthropics/claude-code-action).
+- Authenticates through **OpenRouter** rather than a direct Anthropic API key: the action's `ANTHROPIC_BASE_URL` is
+  redirected to `https://openrouter.ai/api`, using `OPENROUTER_API_KEY` as the credential. This is an unofficial but
+  working setup (OpenRouter exposes an Anthropic-compatible endpoint) — not a first-class integration, so it can break
+  on action/CLI updates.
+- Does **not** gate the merge — it's advisory feedback only, separate from the `build-and-scan` job.
+
 ### Secrets & Variables
 
 | Name                 | Type     | Source                       | Purpose                                                        |
 | -------------------- | -------- | ---------------------------- | -------------------------------------------------------------- |
 | `YC_REGISTRY_ID`     | variable | `vars.YC_REGISTRY_ID`        | Yandex Container Registry ID                                   |
 | `YC_CR_SA_AUTH_JSON` | secret   | `secrets.YC_CR_SA_AUTH_JSON` | YC service account JSON key for registry login                 |
 | `GITHUB_TOKEN`       | secret   | auto-provided                | Authenticated GitHub API requests for `mise` package downloads |
+| `OPENROUTER_API_KEY` | secret   | `secrets.OPENROUTER_API_KEY` | OpenRouter token used to authenticate the Claude PR review     |
 
 ### Cache Strategy