Add GitHub Models tool review workflow

[valentin-vogel]

What changed

Replaces the custom-AI-API approach with a GitHub-native review architecture:

• uses official actions/ai-inference@v2 with GitHub Models
• authenticates with the built-in GITHUB_TOKEN; no OPENAI_API_KEY is required
• stores the assessment as a first-class .prompt.yml under .github/prompts/
• collects a bounded set of official website pages before inference
• posts one persistent PR review comment and updates it on subsequent PR changes
• covers open-source/license status, official-site-linked GitHub repositories, no-code/low-code eligibility, legal/data-governance transparency, pricing, market-position advisory, awesome-list quality, and final recommendation

Security

The workflow uses pull_request_target so fork PRs can use GitHub Models and write a review comment, but it always checks out the trusted default branch and never executes contributor-controlled PR code.

The website fetcher also rejects localhost, private, link-local, multicast/reserved targets and validates redirect destinations before fetching them. Crawling is bounded and restricted to selected pages on the submitted official host. GitHub links found on the official website are recorded as evidence but are not blindly crawled.

Configuration

GitHub Models must be enabled for the repository. The workflow requests models: read and uses GitHub's automatically provided token; no external AI secret is needed.

The prompt currently uses openai/gpt-4o, which is configured in .github/prompts/tool-review.prompt.yml and can be changed/tested through GitHub Models tooling.

Validation

Compared against main: exactly three new files and no existing repository files modified.

Note: because this workflow itself is not yet present on the default branch, its pull_request_target trigger cannot fully exercise this new workflow until it is merged.