Add Tessl change review workflow

[popey]

Summary

• add an advisory Tessl change-review workflow for opened, reopened, and ready-for-review PRs
• allow trusted maintainers to trigger exact-command reruns with @tessl-change-review
• run analysis and publication in separate least-privilege jobs
• load executable publisher code only from the trusted default branch
• reject cross-repository PRs and PR-controlled Tessl configuration before authenticated review execution
• pin tesslio/setup-tessl to an immutable commit
• validate Tessl output, including the reviewed head SHA and multiline comment ranges, before publishing one GitHub review
• cover publisher payload and validation behavior with Node tests in CI

Validation

• node --check .github/change-review/publish-review.mjs
• node --test .github/change-review/publish-review.test.mjs
• workflow YAML parse
• mocked GitHub review publication
• python3 -m unittest discover -s tests -v
• python3 -m py_compile sbom-vm.py generate-test-images.py

The required TESSL_TOKEN Actions secret is configured.

[github-actions]

tessl change review:

Reviewed against skills: review-code-legibility, review-test-risk, review-security-risks

review-code-legibility

• Found 1 issue; overall, the workflow reads clearly but the publisher blurs one accepted comment shape.

review-test-risk

• Found 2 issues; overall, new executable review automation is not covered by the existing Python-only CI.

review-security-risks

• Found 2 issues; privileged review publishing trusts PR-generated data too broadly.

---

To trigger a re-review write a comment that says @tessl-change-review.

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 4 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 4 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>