feat(pr-review): add non-blocking pre-mortem review track

[Troublor]

Summary

Adds an independent, non-blocking pre-mortem track to the shared claude-pr-review action, following the "Pre-mortem based Agent PR Review" methodology (minimal-integration variant):

• New premortem input (default on): after the standard review converges, the lead agent spawns a fresh sub-agent with no shared context that assumes the PR already shipped and caused a production incident, and reconstructs the most credible failure paths (≤8 candidates, top 5 selected).
• Evidence verification: a separate verifier sub-agent confirms or refutes each candidate against the code at head; every candidate gets exactly one status (confirmed / plausible_unverified / rejected / stale / out_of_scope).
• Only confirmed findings are published as inline comments (marked (pre-mortem, confirmed)); plausible_unverified items (≤3) appear only in the review body as verification requests; the rest are suppressed.
• Non-blocking rollout: the review event stays COMMENT, never REQUEST_CHANGES. We collect developer accept/reject feedback in production before considering any gating.
• Prompt-injection guard: the main review prompt and all pre-mortem roles now explicitly treat all repo/PR natural language as untrusted data, not instructions.
• Comment budget: ≤5 Critical/Major + ≤5 Minor/Nit inline comments per round across both tracks (applies even with premortem: off).

Changes

• .github/actions/claude-pr-review/premortem.md (new): role prompts for the Pre-mortem Reviewer, Evidence Verifier, and the lead's Judge/merge rules, staged into .claude-review/ like rubric-detail.md.
• .github/actions/claude-pr-review/action.yml: new premortem input; Task tool enabled when the track is on; pre-mortem orchestration block injected into the prompt; security-boundary paragraph; Phase 5 comment cap.
• .github/workflows/claude.yml: timeout-minutes 25 → 35 for the pr-review job (the track adds two rounds of sub-agent work).
• .github/actions/README.md: document the new input and the 35-minute timeout recommendation.

Verified locally: both YAML files parse; the compose script passes bash -n and was executed in a simulated CI environment for both premortem=on (orchestration block emitted, Task allowed, premortem.md staged) and premortem=off (block empty, no Task, nothing staged).

Note: since this PR touches claude.yml, the automated pr-review job skips itself on this PR (existing self-modification guard) — first real-world run will be on the next PR after merge.