fix(ci): address review round 2 — injection, cancellable polling, concurrency [skip-regression-check]

1. Script injection: use env vars for workflow_dispatch inputs instead
   of ${{ inputs.* }} interpolation in run blocks.

2. Cancellable polling: sleep in 1s increments so GitHub can cancel
   between iterations instead of blocking on a single long sleep.

3. Remove workflow_dispatch from claude-review — fails without PR
   context. Re-trigger by removing/re-adding staging-promotion label.

4. Add concurrency group to claude-review to prevent duplicate
   reviews consuming API credits.

5. Fix dead code in test.yml roll-up (redundant variable init).

6. Add comment explaining --delete-branch safety (GitHub auto-retargets
   chained PRs, verified in ironclaw-ci-test).

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

.github/workflows/claude-review.yml

@@ -3,7 +3,6 @@ name: Claude Code Review
 on:
   pull_request:
     types: [opened, labeled]
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -11,6 +10,10 @@ permissions:
   issues: write
   id-token: write
 
+concurrency:
+  group: claude-review-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   review:
     name: Claude Code Review

.github/workflows/staging-ci.yml

@@ -41,6 +41,8 @@ jobs:
 
       - name: Check for changes since last tested
         id: check
+        env:
+          FORCE_RUN: ${{ inputs.force }}
         run: |
           CURRENT_HEAD=$(git rev-parse HEAD)
           echo "current_head=${CURRENT_HEAD}" >> "$GITHUB_OUTPUT"
@@ -70,7 +72,7 @@ jobs:
           fi
 
           # Force override from workflow_dispatch
-          if [ "${{ inputs.force }}" = "true" ]; then
+          if [ "$FORCE_RUN" = "true" ]; then
             echo "Force run requested"
             HAS_CHANGES=true
             if [ -z "$DIFF_RANGE" ]; then
@@ -273,7 +275,8 @@ jobs:
             fi
 
             echo "Claude review status: ${STATUS} (${ELAPSED}s elapsed)"
-            sleep "$INTERVAL"
+            # Sleep in 1s increments so GitHub can cancel between iterations
+            for _i in $(seq 1 "$INTERVAL"); do sleep 1; done
             ELAPSED=$((ELAPSED + INTERVAL))
           done
 
@@ -371,9 +374,10 @@ jobs:
         id: evaluate
         env:
           PR_NUMBER: ${{ needs.create-promotion-pr.outputs.pr_number }}
+          SKIP_GATE: ${{ inputs.skip_claude_gate }}
         run: |
           HAS_BLOCKING="${{ steps.process-findings.outputs.has_blocking }}"
-          SKIP_INPUT="${{ inputs.skip_claude_gate }}"
+          SKIP_INPUT="$SKIP_GATE"
 
           if [ "$HAS_BLOCKING" = "true" ]; then
             echo "::warning::Claude review found blocking issues (CRITICAL ≥80 confidence)"
@@ -400,6 +404,8 @@ jobs:
         run: |
           if [ -n "$PR_NUMBER" ]; then
             echo "Merging promotion PR #${PR_NUMBER}"
+            # --delete-branch is safe: GitHub auto-retargets any chained PRs
+            # targeting this branch to the next base (verified in ironclaw-ci-test)
             gh pr merge "$PR_NUMBER" --merge --delete-branch
             echo "merged=true" >> "$GITHUB_OUTPUT"
           fi

.github/workflows/test.yml

@@ -145,7 +145,6 @@ jobs:
           fi
           # Gated jobs: must pass on promotion PRs / push, skipped on developer PRs
           for job in telegram-tests wasm-wit-compat docker-build windows-build version-check; do
-            result="${{ needs.telegram-tests.result }}"
             case "$job" in
               telegram-tests) result="${{ needs.telegram-tests.result }}" ;;
               wasm-wit-compat) result="${{ needs.wasm-wit-compat.result }}" ;;