chore(ci): add codegenie review workflow

[pratikspatil024]

Summary

Adds on-demand codegenie AI review to this fork, matching what already runs in
bor and heimdall-v2. Reviews are requested explicitly by commenting
codegenie review on a PR — no automatic run on open or on push, so this adds
nothing to the normal CI path and blocks nothing.

The workflow file is byte-identical to bor's: codegenie@v0.5.1,
anthropic/claude-opus-5:high, a preflight that fails fast if
CLAUDE_API_KEY is unset, and a checkout pinned to the default branch rather
than the PR head so a PR cannot modify the reviewer that reviews it.
CLAUDE_API_KEY is an org secret already available to this repo.

Because this fork tracks upstream, codegenie.toml is tuned for PoS-authored
changes rather than upstream merges — and since the trigger is comment-only,
upstream-merge PRs simply never invoke it.

• critical — consensus/** (state machine, voting, timeouts, WAL replay),
  state/** (block execution, validator-set updates, app-hash determinism),
  types/** (vote/block/validator-set types and voting-power validation),
  blocksync/** (catch-up and peer-height reporting), privval/**
  (double-sign protection), mempool/**, and abci/**.
• high — store/** (block store, pruning and compaction), evidence/**,
  statesync/**, p2p/**.
• low — light/** (light client is not used in the PoS stack) and
  test/** (upstream e2e harness).

Generated output is skipped: protobuf bindings and the mockery destinations
under **/mocks/**.

	files
Total tracked	1426
Skipped as generated	45
Marked critical	211

Executed tests

No runtime behavior changes, so there is nothing for CI to exercise. What was
verified instead:

• Every rule validated against codegenie's config schema
  (src/config/schema.ts), which is .strict() and requires reason on every
  rule. All enum values valid.
• Every glob matched against the actual file tree at this commit — no rule
  matches zero files. This caught an api/** skip rule copied from another
  repo; this fork has no such directory, so it was dropped.
• Rule precedence checked against src/git/file-classifier.ts:258-266
  (last matching rule wins; skips only compete with rules that set a
  processingMode), then spot-checked: consensus/state.go → critical
  [consensus], blocksync/reactor.go → critical [sync],
  privval/signer_client.go → critical [keys], p2p/switch.go → high,
  light/client.go → low, abci/types/types.pb.go → skip,
  evidence/mocks/block_store.go → skip.
• yamllint clean on the workflow against this repo's own
  .github/linters/yaml-lint.yml, since markdown-linter.yml runs
  super-linter with VALIDATE_YAML: true over the whole codebase.

End-to-end behavior of this exact workflow file is already proven in bor —
20 successful runs since 2026-07-26.

Rollout notes

Not consensus-affecting. No coordinated upgrade, no operator-facing change,
nothing in the built binary. CI-only, and non-blocking by construction: the
workflow only ever fires from an explicit PR comment, and codegenie posts a
COMMENT-type review that never approves or requests changes.

No effect on upstream syncs. Findings are advisory and do not replace human
review.