fix(ci): address code review findings for hardened AI review

Workflow fixes:
- Use randomized heredoc delimiter to prevent output injection
- Add file existence guard with fallback inline prompt
- Use direct cat instead of echo variable (preserves content exactly)

Prompt fixes:
- Add 4 missing CCS rules: TTY/NO_COLOR, idempotent installs,
  dashboard parity, documentation mandatory
- Qualify suppression list to exclude security/correctness/CCS concerns
- Change severity labels from Critical/Medium/Low to High/Medium/Low
  to match maintainer feedback loop parser expectations

.github/workflows/ai-review.yml

@@ -185,11 +185,20 @@ jobs:
       - name: Load review prompt
         id: review-prompt
         run: |
-          PROMPT_CONTENT=$(cat .github/review-prompt.md)
+          PROMPT_FILE=".github/review-prompt.md"
+          if [ ! -f "$PROMPT_FILE" ]; then
+            echo "::warning::review-prompt.md not found — using fallback prompt"
+            PROMPT_FILE=""
+          fi
+          DELIMITER="REVIEW_PROMPT_$(openssl rand -hex 16)"
           {
-            echo "content<<REVIEW_PROMPT_EOF"
-            echo "$PROMPT_CONTENT"
-            echo "REVIEW_PROMPT_EOF"
+            echo "content<<${DELIMITER}"
+            if [ -n "$PROMPT_FILE" ]; then
+              cat "$PROMPT_FILE"
+            else
+              echo "Perform a thorough code review. Flag security issues, logic errors, and missing error handling. Follow the repository CLAUDE.md for project-specific guidelines."
+            fi
+            echo "${DELIMITER}"
           } >> "$GITHUB_OUTPUT"
 
       - name: Run Claude Code Review