feat: centralize Harness PR review workflow

[aidandaly24]

Summary

• add a reusable AgentCore Harness PR review workflow
• add a pinned composite action that invokes Harness, validates its final response, and publishes a formal GitHub review
• keep repository-specific prompts in caller repositories
• support both central Secrets Manager and existing direct GitHub-secret consumers
• mint the existing AgentCore DevX GitHub App token per run for consistent bot attribution
• let Security Review callers supply an exact base-branch allowlist while preserving ["main"] as the default

Why

Harness review mechanics are currently duplicated across agentcore-cli,
private-agentcore-cli-staging, and agent-inspector. Those copies have
already drifted, and their baked GitHub API credentials can complete a review
without successfully publishing it.

The shared workflow keeps the short-lived GitHub App token on the Actions
runner, passes only review context to Harness, requires a delimited final
review, and fails if GitHub rejects publication.

The Security reusable currently hardcodes main, which prevents the
agentcore-cli migration branch from opting into review even when its caller
trigger includes refactor.

Verification

• python -m unittest test_harness_review.py
• python -m py_compile harness_review.py test_harness_review.py
• parsed every shared workflow and composite-action YAML file
• git diff --check

The Harness action is pinned by the reusable workflow to commit
20441d03ec1be9944a2958be6b1264cda49a1772.