ci(claude): enable @claude to fix bugs and commit from comments

Configure the @claude summon workflow so it can actually produce a
verified fix when asked in an issue/PR comment:

- use_commit_signing: bot commits show as Verified
- --allowedTools Bash: lets Claude build/test to verify the fix before
  committing (default allowlist blocks Bash). Safe because the job `if`
  gate restricts this to OWNER/MEMBER/COLLABORATOR.
- --max-turns 30: enough turns to investigate -> fix -> verify

Auto-commit/PR is already built into claude-code-action and the
required write permissions were already present, so no permission
changes are needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/claude.yml

@@ -50,10 +50,15 @@ jobs:
           additional_permissions: |
             actions: read
 
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
+          # Sign the bot's commits so they show as "Verified". The action commits
+          # automatically — on a PR comment it pushes to that PR's branch; on an
+          # issue comment it opens a new claude/* branch + PR with the fix.
+          use_commit_signing: true
 
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr:*)'
+          # No custom prompt: Claude performs the instructions in the @claude comment.
+
+          # Let summoned runs actually fix bugs: allow Bash so Claude can build/test
+          # and verify the change before it commits, plus enough turns to investigate.
+          # File edits (Edit/Write) and git push are handled by the action itself.
+          # Safe because the job `if` gate restricts this to OWNER/MEMBER/COLLABORATOR.
+          claude_args: '--allowedTools Bash --max-turns 30'