ci: review uci's own pull requests with seidroid, retire ai-review

[bdchatham]

Summary

Reviews uci's own pull requests with seidroid, and retires the legacy ai-review caller. Every other repository that calls seidroid-review.yml already uses it; uci was still on ai-review.yml at v0.0.22.

Blocked on one secret: uci needs OMNIGENT_MACHINE_CLIENT_SECRET as a repository or organization secret. This PR's own run confirms it: the Guard job stops with OMNIGENT_MACHINE_CLIENT_SECRET is not set on the calling repository. The App secrets PLATFORM_CODE_AGENT_APP_ID and _PK are already visible to uci. This PR stays a draft until the secret exists.

Change

• seidroid.yml (new), modelled on sei-chain's caller and pinned to v0.0.26 (0dc48cf):
  • Reviews on PR open, ready, sync and reopen, and on @seidroid review in a top-level comment, an inline comment or a review body.
  • Closes on a top-level comment that starts with @seidroid review close. A comment that starts with the review command and quotes the close command later runs neither job, so nothing is destroyed. Closing the PR reclaims the session.
  • Skips runs that Dependabot triggers, because they get only Dependabot's secrets.
• ai-assist.yml: v0.0.22 → v0.0.26, so the assistant no longer answers @seidroid review close (fix(ai-assistant): reserve @seidroid review close for the review workflow #117).
• ai-review-self.yml: deleted.

The pin is a released commit, not ./. A pull request that changes seidroid-review.yml is therefore reviewed by the last release, so a broken change cannot disable its own review.

approve-on-success: true matches the sibling repositories. uci's main has no branch protection and its one ruleset is disabled, so a bot approval satisfies no rule. uci has no REVIEW.md, so the reviewer uses the driver's own checklist; the workflow logs a warning for the missing file.

Verification

• actionlint on both files: clean.
• The two job conditions, checked against six comment shapes: a review command reaches review from all three surfaces, a top-level close command reaches close, and a review comment that quotes the close command reaches neither.

After the secret is added, @seidroid review on this PR is the end-to-end check.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
GitHub Actions wiring only—no application code—but Seidroid reviews depend on adding OMNIGENT_MACHINE_CLIENT_SECRET and change how PR automation runs.

Overview
Replaces legacy self-hosted AI review with Seidroid and bumps shared UCI workflow pins to v0.0.26 (0dc48cf).

ai-review-self.yml is removed; new seidroid.yml wires three reusable jobs (review, close, reclaim) to seidroid-review.yml at a released commit (not ./) so PRs that change review logic are still reviewed by the prior release. Reviews run on PR open/sync/reopen and on @seidroid review; @seidroid review close and PR close tear down sessions. Dependabot-triggered review runs are skipped when machine secrets are unavailable.

ai-assist.yml is updated to the same v0.0.26 ref for uci-ref and the reusable workflow uses pin. Review jobs pass approve-on-success: true and map app credentials from existing PLATFORM_CODE_AGENT_* secrets plus OMNIGENT_MACHINE_CLIENT_SECRET (required for token minting; runs fail until a repo admin adds it).

^{Reviewed by Cursor Bugbot for commit 4211d74. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b9accf6. Configure here.}