Add on-pull-request workflow for AI code review

[james-in-a-box]

Add missing on-pull-request.yml workflow for AI code review

PR #146 implemented the Phase 1 AI code review scripts
(build-review-prompt.sh, post-review-comments.sh) and the
prompt-file action input, but the workflow file could not be pushed
due to GitHub App permission restrictions on the workflows scope.

This PR adds the missing .github/workflows/on-pull-request.yml
that wires everything together. The workflow:

• Triggers on PR open, synchronize, ready_for_review, and reopen
• Skips draft PRs, bot PRs, and PRs with [skip-review] in title
• Uses cancel-in-progress to abort stale reviews on new pushes
• Checks out main for trusted prompt building (same security
  pattern as on-mention.yml)
• Runs build-review-prompt.sh to construct the review prompt
• Runs the egg action with the prompt-file and dynamic model
• Runs post-review-comments.sh to parse output and post inline
  review comments

Issue: #134
Related: #146 (Phase 1 implementation), #140 (plan)

Test plan:

• Verify workflow triggers on a test PR
• Confirm it skips drafts and [skip-review] PRs
• Confirm cancel-in-progress works on rapid pushes
• Validate inline comments are posted correctly

Authored-by: egg