fix(ci): restore refactor PR automation

[aidandaly24]

Description

Restore PR automation for pull requests targeting refactor and make AgentCore Harness review publishing reliable.

• Include refactor in CodeQL, PR Size and Title, and Claude Security Review branch filters.
• Fetch existing PR discussion with the workflow's short-lived GITHUB_TOKEN.
• Require Harness to return a delimited final review and publish it from the workflow runner.
• Fail the workflow when Harness omits a final review or GitHub rejects the review.
• Remove the baked GitHub API credential from future Harness images.

The workflow token remains on the GitHub Actions runner and is not sent to the Harness runtime.

Related Issue

N/A - workflow repair for the unreleased refactor branch.

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Additional verification:

• python -m unittest test_harness_review.py
• python -m py_compile harness_review.py test_harness_review.py
• npm run format:check
• Parsed every workflow YAML file
• Live dispatch 31832968154 reached the secret-fetch step but the OIDC trust policy rejects non-main refs; rerun after this PR merges to exercise Harness and GitHub review publishing end to end

Checklist

• I have read the CONTRIBUTING document
• I have added necessary tests that prove the fix is effective
• I have updated the documentation accordingly
• No new example is needed for this CI-only change
• My changes generate no new warnings
• No dependent package changes are required

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[github-actions]

Package Tarball

aws-agentcore-0.27.0.tgz

How to install

gh release download pr-2002-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.27.0.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	40.65%	15274 / 37572
🔵	Statements	39.92%	16287 / 40799
🔵	Functions	34.85%	2614 / 7499
🔵	Branches	33.96%	10185 / 29984

Generated in workflow #4339 for commit ea4e78b by the Vitest Coverage Report Action

[aidandaly24]

Closing as superseded. The security branch policy and Harness reviewer implementation need to move into aws/agentcore-devx-devtools; the replacement CLI PR will keep only thin caller triggers pinned to the shared implementation.