fix(ci): fire pr-review caller on ready_for_review; partition concurrency by draft flag

[topcoder1]

Closes the last fail-open residue of the pr-review ready_for_review campaign (45-repo audit, 2026-07-15; reference fix whois-api-llc/wxa-mcp-server#344): this repo's caller already has the draft-partitioned concurrency group but its pull_request types still lack ready_for_review.

Why it matters: the reusable claude-review.yml gates on draft == false, so a PR opened as draft skips the required review / Claude Review at opened — and without this event, marking the PR ready fires nothing the workflow hears. The check stays skipped, which GitHub counts as a satisfied required context, so the PR can merge green and unreviewed (wxa-mcp-server#339 merged 7s after readying this way; fleet policy makes draft the standard auto-merge opt-out, so manual-merge PRs are precisely the ones hit). It resurfaced concretely tonight on whois-api-llc/disposable-email-domains#167, and the central draft-gate lint (ci-workflows#115) now fails every PR in a repo whose caller has the gap.

One line: types: [opened, synchronize, reopened, ready_for_review]. No behavior change for non-draft PRs.

Auto-merge rationale: manual click-merge — touches .github/workflows/** (fleet policy).

🤖 Generated with Claude Code

[github-actions]

Auto-merge refused — risk:blocked: changed files match the base branch's .github/risk-paths.yml (evaluated directly by the auto-merge gate — no label round-trip).

This PR touches a path category in .github/risk-paths.yml's blocked:
list (workflows, classifier config, CODEOWNERS, secrets, infra). Per the
global CLAUDE.md policy, blocked-class PRs require admin click-merge — no
label or status-check bypass applies.

If this is misclassified, edit the caller repo's .github/risk-paths.yml.

[github-actions]

Risk class: blocked — manual merge required.

This PR touches one of the blocked path categories from .github/risk-paths.yml (Dockerfiles, docker-compose, .github/workflows/**, **/.env*, **/secrets*, infra/, terraform/, k8s/, or the classifier config itself).

Auto-merge is refused by claude-author-automerge.yml. A maintainer should review the diff and click "Squash and merge" themselves.

(This is a policy notice, not a code-quality failure. The classify job itself does not fail — required CI checks remain authoritative for "is the code green.")