feat(advisory-review): share the PR review and test coverage checks - #31

Added a commit that runs both checks on Opus 5.5 at max effort. The action moves to v1.0.236 (Claude Code 2.1.284) because the old pin predates Opus 5.5, and the review job timeout goes from 35 to 60 minutes since max effort makes each turn slower.

The naming test now allows the --model line, because a model ID always contains the vendor name. Any other mention still fails it.

@bleggett This PR now does that. Both checks live here as one reusable workflow, .github/workflows/advisory-review.yml, with the publisher, prompts and tests under advisory-review/. A repo pins it by commit and keeps a 48-line caller plus its own .github/review/focus.md and test-layers.md, which say what matters in that repo. The two repos that already had copies drop about 1,800 lines each in their migration PRs.

It is a reusable workflow rather than a composite action like the others here because each check runs as two jobs with different permissions. The job that runs the model gets a read-only token, and the job that posts the review runs no model. A composite action runs inside the caller's job with the caller's token, so every repo would have to set up that split itself.