fix(ci): address 3 CodeRabbit findings on AI Validation workflow

CR finally got credits and posted three substantive findings on b0fdd07.

1. CRITICAL — line 281, model: input is silently ignored.
   anthropics/claude-code-action@v1 removed the top-level `model`
   input; the migration guide says model selection now travels via
   `claude_args: --model <name>`. With the old form, the action used
   its DEFAULT model on every run instead of the pinned claude-opus-4-7,
   defeating the version pin entirely. CR even ran a web query and
   actionlint to verify (actionlint output: "input 'model' is not
   defined in action 'anthropics/claude-code-action@v1'"). Moved
   --model claude-opus-4-7 into claude_args.

2. MAJOR — line 135, secrets template-expanded into shell text.
   `[ -z "${{ secrets.VYOS_APP_ID }}" ]` lets GH Actions do
   ${{ ... }} expansion BEFORE bash parses the script. A secret
   containing a single quote, backtick, or $ would either break the
   test syntactically or be evaluated by the shell. The same hygiene
   that justifies the prepare/validate split applies here. Moved
   the three secrets to an env: mapping; the script now reads
   "$VYOS_APP_ID" etc., handed to bash as already-quoted env vars.

3. NIT — line 7, concurrency group brittle outside PR events.
   `github.event.pull_request.number` is empty on workflow_dispatch
   or schedule; the group would collapse to "ai-validation-" and
   unrelated runs cancel each other. Defensive fix: fallback to
   `github.ref`. Today the workflow only fires on
   pull_request_target so this is purely future-proofing.

Same changes being synced to canonical scripts/ai-validation.yml
in vyos-docs-opus-reviewer PR #13.

🤖 Generated by [robots](https://vyos.io)

0 files changed, 0 insertions, 0 deletions