ci: add read-only PR review workflow

.github/workflows/pr-review.yml

@@ -0,0 +1,37 @@
+name: PR Review
+
+on:
+    pull_request_target:
+        branches: [main]
+        types: [opened, synchronize, reopened, edited]
+
+permissions:
+    contents: read
+    pull-requests: read
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+jobs:
+    validate:
+        runs-on: ubuntu-latest
+        timeout-minutes: 10
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  ref: ${{ github.event.pull_request.base.sha }}
+                  fetch-depth: 1
+                  persist-credentials: false
+            - uses: astral-sh/setup-uv@v6
+            - uses: actions/setup-python@v5
+              with:
+                  python-version: "3.11"
+            - name: Install dependencies
+              run: uv sync --frozen --no-install-project
+            - name: Review pull request
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+                  GITHUB_REPOSITORY: ${{ github.repository }}
+                  PR_NUMBER: ${{ github.event.pull_request.number }}
+              run: uv run python scripts/review_pr.py