docs: record Claude App + cross-account prereqs in caller template

[vpciii]

Fixes the two gaps that surfaced wiring up the first adopters:

• The reviewer's tag mode posts via the Claude GitHub App, so installing it on the account is a prerequisite — the ANTHROPIC_API_KEY alone isn't enough (the first smoke test 401'd until the app was installed).
• A private reusable workflow can only be called within one account — a repo in another org/user can't call vpciii/methodology's; it needs a standalone copy.

Updates templates/github/claude-review.yml prereqs accordingly. ADR 0021 left as-is (append-only); the operational prereqs belong in the template.

This is also the first PR the methodology repo's own reviewer should comment on. 🙂

🤖 Generated with Claude Code

[claude]

Claude finished @vpciii's task in 51s —— View job

---

Review

Checked the change against ADR 0021, the reusable workflow it documents, and the repo's Conventional Commits convention.

Both new prerequisites are accurate. The reusable workflow sets track_progress: true (.github/workflows/claude-review.yml), which posts via the Claude GitHub App — so the "API key alone isn't enough, install the app" note (templates/github/claude-review.yml:5-7) matches how the action actually behaves. The cross-account caveat (:14-16) is also correct: a private reusable workflow is only callable within the owning account, and ADR 0021 already anticipates this ("reusable workflows are the supported way to share across private repos", line 60). Numbering the steps 1–3 and labeling the one-time vs per-repo steps is a clear improvement.

Process is clean. Doc-only change, single Conventional Commit (docs: …), and the docs ride along with the operational reality they describe (ADR 0020). Leaving ADR 0021 untouched as append-only is the right call — operational prereqs belong in the template, not retrofitted into an accepted decision record.

One optional follow-up (non-blocking): ADR 0021's Consequences (adr/0021-…md:65-68) still lists only "(a) the caller and (b) its own ANTHROPIC_API_KEY secret" as adopter requirements — the App-install prereq this PR surfaces isn't reflected there. That's consistent with your stated "ADR is append-only" decision, so it's fine to leave; if you ever revisit 0021, a one-line nod to the App prereq would keep the two in sync. Not something to change in this PR.

Nice first dogfood PR for the reviewer. 🙂 LGTM.