feat(slack-notify): add bot-token path with thread + update support

Lets callers conditionally include rows by resolving the value
expression to '' rather than constructing the YAML in a shell step.

…ain push

This repo is public and intended to be reusable across jitsucom repos.
Without a LICENSE file it sits under default copyright (no grant), which
is inconsistent with that intent. MIT matches the rest of jitsucom's
permissive-licensed public repos.

Raise the bar for the REQUEST_CHANGES verdict so it fires only on new,
critical issues — real bugs, security holes, data loss, user-visible
regressions. Non-critical and uncertain findings now post as COMMENT
inline comments instead, so false positives no longer block PRs.

Drop REQUEST_CHANGES from the PR review verdict — branch protection now
gates merges by requiring all review threads to be resolved, so a COMMENT
is enough to make the author address a finding without the AI blocking
the merge itself.

"Avoid merge commits" meant don't merge default branch into feature
branches — always rebase. For PRs, merge commit is now the default
merge method and rebase-and-merge is also allowed. Squash stays off.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

codex-action's write-access check queries the collaborators API, which
returns permission 'none' for the github-actions[bot] actor and aborts
the run with "Actor 'github-actions[bot]' is not permitted to run this
action". This blocked AI review on the automated security-fix PRs, which
are opened under the repo's own GITHUB_TOKEN (actor github-actions[bot]).

Pass allow-bots: true so codex-action whitelists the GitHub-owned
github-actions[bot] specifically. The review still posts via the
AI_CODE_REVIEW app token, which already has PR write — the actor check
was the only gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>