[Nemo157]

Replace the ANTHROPIC_API_KEY secret in claude-chiplab-smoke.yml with claude-code-action's Workflow Identity Federation inputs.

[claude]

Change Summary

Replaces the ANTHROPIC_API_KEY secret in .github/workflows/claude-chiplab-smoke.yml with the three claude-code-action workload identity federation inputs, read from ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_CHIPLAB_SMOKE_FEDERATION_RULE_ID and ANTHROPIC_CHIPLAB_SMOKE_SERVICE_ACCOUNT_ID.
Header, permissions and step comments are updated to describe the OIDC exchange and the job_workflow_ref claim the federation rule must trust.
No issue reference is given in the PR or commit.

Both points from the previous review are addressed: the commit now carries the ci: conventional-commit prefix, and the ANTHROPIC_ORGANIZATION_ID comment now reads (shared org variable).
The input names match the ones forwarded by veecle/style-guide's claude-review action, the job_workflow_ref value is correct for a non-reusable workflow triggered by issue_comment on the default branch, and no other file in the repo references ANTHROPIC_API_KEY.

✅ Review complete - no new issues found

[luchhh]

Since this is meant to be used as a CI template for users and probably we will raise the barrier to entry with this change. Could we keep WIF for our CI but show anthropic_api_key as a commented-out alternative?

[Nemo157]

Mmmm, true. What I could do here is switch over to just a service account API key instead, that seems good enough for this workflow.