Add org-wide security review gate workflow

[ludov04]

What

Adds a Security review workflow to conveo/.github, intended to be enforced org-wide via an organization ruleset ("Require workflows to pass before merging") rather than copied into every repo.

Why

New repos should automatically get a protected main with the security reviewer gating merges, without per-repo setup. An org ruleset targeting all repositories (current + future) + this centrally-defined required workflow achieves that. Because the ruleset injects this workflow into each target repo's merge gate, the target repo doesn't need its own copy.

Notes

• The action is referenced by its cross-repo path (conveo/agentgateway/.github/actions/claude-security-review-via-gateway@main) rather than a local ./ path, since this workflow runs in the target repo's context, which doesn't contain that composite action.
• Auth is GH OIDC through the agentgateway — no Anthropic key in any repo. Works for all repos because the gateway accepts any repo:conveo/ OIDC subject.
• Fails closed: any HIGH/CRITICAL finding, a scanner error, or an incomplete scan blocks the merge.

Follow-up (after merge to main)

1. Create the org ruleset: target All repositories, default branch, rules = require PR + block force-push + restrict deletion + Require workflows to pass → conveo/.github · .github/workflows/security-review.yml @ main.
2. Confirm org Actions policy allows this workflow/action to run in every repo.

🤖 Generated with Claude Code