open-code-review-setuplisted

# Open Code Review Setup Lifecycle operation: detect → install → configure → verify. For PR metadata, agent labels, and the token-spend semantics of `rule.json`, use `ai-agent-pr-metadata` — this skill only installs and validates the plumbing. ## 1. Detect ```sh ls .opencodereview/ .github/workflows/ 2>/dev/null | grep -i -E 'ocr|open-code-review' gh variable list --repo <owner>/<repo> | grep OCR_ gh secret list --repo <owner>/<repo> | grep OCR_LLM_AUTH_TOKEN ``` - All present → audit only: confirm the action is pinned to a SHA, the maintainer gate matches the repo owner, and the model var is still wanted. Do not clobber local customizations. - Anything missing → install/configure the missing pieces below. ## 2. Install Branch per git workflow (`feature/issue-N-open-code-review`, PR to the default integration branch — never commit to `main`/`staging` directly). 1. Copy `templates/open-code-review.yml` and `templates/ocr-manual-review.yml` into `.github/workflows/`. 2. Set the maintainer gate in both files (`github.event.pull_request.user.login == '<maintainer>'` / `github.event.comment.user.login == '<maintainer>'`) to the account that opens PRs (the bot account whose token creates PRs, if agents open them). 3. Copy `templates/rule.json` to `.opencodereview/rule.json` and adapt `exclude` to the stack: - JS/TS: `node_modules/**`, `dist/**`, `pnpm-lock.yaml`, `package-lock.json` - PHP/Laravel: `vendor/**`, `storage/**`, decide explicitly on `tests/**` (built-in ex