feat: review git sync pull requests with wmill review (#12055)

* feat: add ai review to deployment requests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: bound ai review fetches and surface unreadable items

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: add fix in ai session and model picker to deployment ai review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: add workspace instructions for deployment ai review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: read review instructions from the parent and bind ai review to the fork

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: pin the fix-all session preview to the fork's compare page

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: show the protection-rule bypass toggle inline

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: make the bypass toggle small and red

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: drop workspace-settings instructions from deployment ai review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: folder-scoped review instructions for the deployment ai review

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: review the selected items with ai on compare and deploy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: keep reviewing when review instructions cannot be listed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: say the review instruction floor is a prompt request, not enforcement

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: mark an ai review out of date when its items change

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 77703cf32e58964906d87ee83ddda44b5b8d1b7e

This commit updates the EE repository reference after PR #926 was merged in windmill-ee-private.

Previous ee-repo-ref: e30ab9e69d1854fcaed5620c934ace32acb0a729

New ee-repo-ref: 77703cf32e58964906d87ee83ddda44b5b8d1b7e

Automated by sync-ee-ref workflow.

* feat: review git sync pull requests with wmill review

* fix: withhold retyped resources and encryption keys, fall back from the responses route

* fix: withhold fileset children, workspace-specific resources and pathspec-named files

* feat: include the ready-to-post review in wmill review --json

* feat: review a workspace synced into a repository subfolder

* docs: say what wmill review takes from flags rather than wmill.yaml

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

docs/git-sync-pull-design.md

@@ -734,6 +734,35 @@ those PRs). A timeout on a repository pinned to a sync script older than the one
 pushed commits names that as the reason. Known limit (accepted for v1): the fork's status is workspace-wide (all its
 tested items), which for the one-fork-per-PR model equals the PR's scope.
 
+### Phase 8: AI review of pull requests (`wmill review`), CLI implemented
+
+The deployment request panel's AI review, run on a pull request against a synced repository.
+One review, three runners: the panel, `wmill review` in a customer's CI, and later an
+instance-side job on the `pull_request` webhook (a git sync setting next to `fork_open_prs`,
+running `wmill review --json` from a pinned hub script and posting through the installation).
+
+- **One source for the review.** Prompt, size budget, withheld kinds and answer parsing live
+  in `frontend/src/lib/components/deploymentRequest/aiReviewCore.ts`, which imports nothing
+  but `folderInstructionScopes.ts`. `bun run gen:ai-review` vendors both into the CLI;
+  `cli/test/ai_review_bundle_unit.test.ts` fails on drift.
+- **One provider path.** The CLI calls `POST /api/w/{ws}/ai/complete`, which sends one
+  request through the `windmill-ai` query builders (`one_shot::complete_text`, shared with
+  agent-step compaction). A client of its own would have to copy the per-model handling the
+  frontend's `copilot/lib.ts` carries. A provider key held in CI is not supported for that
+  reason.
+- **Nothing from the head steers the review.** Review instructions (`ai_review_instruction`
+  resources) are read from the base branch's tip, never the pull request; a change to one is
+  reviewed as a change. The checkout's `wmill.yaml` and local profiles are never read, since
+  a `workspaces:` entry there could point the token at another server: base URL, workspace
+  and token come from flags only. Folder suffixes are matched in both formats rather than
+  read from config.
+- **Anchors.** The model reads each file as a numbered diff (`R<n>` head, `L<n>` base) with
+  20 lines of context. A comment is placed on a line only if GitHub's own 3-line-context diff
+  shows it, since one unplaceable comment fails the whole review; anything else goes in the
+  review body, as does everything after a 422.
+- **Reruns.** One review per head commit, found by a `<!-- windmill-ai-review:<sha> -->`
+  marker. A rerun still calls the model so `--fail-on` keeps gating, and skips the post.
+
 ## 16. Alternatives considered
 
 **Portal as webhook proxy (the rejected "option 2").** Subscribe the managed app