ci: let the claude bot trigger the PR audit workflows

claude-code-action rejects any non-human actor unless it is named in
allowed_bots, so PRs opened by the claude app failed both the agent
instructions audit and the REVIEW.md drift audit before Claude ran, and
landed with two permanently red checks and no audit coverage.

Allowlists the bot by name rather than "*", so other bots (dependabot in
particular) still cannot trigger these workflows. Both jobs already skip
PRs whose head is not in this repo, so fork PRs remain excluded.

Author: matt-aitken

.github/workflows/check-review-md.yml

@@ -38,7 +38,7 @@ jobs:
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           use_sticky_comment: true
-          allowed_bots: "devin-ai-integration[bot]"
+          allowed_bots: "devin-ai-integration[bot],claude[bot]"
 
           claude_args: |
             --max-turns 30

.github/workflows/claude-md-audit.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           use_sticky_comment: true
-          allowed_bots: "devin-ai-integration[bot]"
+          allowed_bots: "devin-ai-integration[bot],claude[bot]"
 
           claude_args: |
             --max-turns 25