Fix review workflow: add engine:copilot block and workflow_dispatch

[PureWeen]

The review.agent.md was missing the engine: block needed for the Copilot agent runtime to process the workflow. Without it, the /review slash command and auto-triggers weren't being picked up.

Changes:

• Added engine: id: copilot, model: claude-sonnet-4.6 — tells the platform to use the Copilot agent runtime
• Added workflow_dispatch with pr_number input for manual triggering
• Added top-level if: condition for event filtering

Modeled after dotnet/maui's copilot-evaluate-tests.md format.

[PureWeen]

🔍 Multi-Model Code Review — PR #594

PR: Fix review workflow: add engine:copilot block and workflow_dispatch
CI Status: ⚠️ No CI checks reported
Reviewers: 3 independent reviewers

---

🔴 CRITICAL (found and fixed during review)

Safe-output keys must use hyphens, not underscores

Flagged by: 2/3 reviewers, confirmed by recompilation

PR #593 commit 10 changed safe-output keys from hyphens to underscores. This caused gh aw compile to silently drop them — the compiled lock file had NO PR review tools (create_pull_request_review_comment, submit_pull_request_review, add_comment all missing). The safe_outputs job also lacked pull-requests: write.

Root cause: gh-aw expects hyphens (kebab-case) in source .md files and normalizes to underscores in compiled output. msbuild's original format was correct.

Fix applied: Reverted to hyphens in commit f4c238d. Recompilation confirmed all 3 tools + pull-requests: write now appear in the lock file.

---

✅ Verified Correct

Change	Status
engine: id: copilot, model: claude-sonnet-4.6	✅ Correct — required for agent runtime
workflow_dispatch with pr_number input	✅ Correctly wired in lock file
if: condition (issue_comment || workflow_dispatch)	✅ Matches compiled output
pull_request trigger removed	✅ Required — gh-aw can't combine with slash_command
Label management removed	✅ Clean — no orphaned references
PR number expression includes inputs.pr_number	✅ Covers all trigger paths
permissions: read in source	✅ Correct — gh-aw strict mode requires safe-outputs for writes
gh-aw-workflows.instructions.md from dotnet/maui	✅ Safe — documentation only
.gitattributes marks lock as generated	✅ Correct
actions-lock.json pins action SHAs	✅ Correct

---

🟢 MINOR

Description says "automatically" but auto-trigger is removed

Flagged by: 1/3 reviewers

The workflow description still says "automatically for trusted contributors" but pull_request auto-trigger was removed. Can be updated in follow-up. Not blocking — the auto-trigger can be restored via a separate workflow file.

---

Recommended Action

✅ Approve — the critical safe-outputs issue was found and fixed during this review. All changes are now correct and the workflow compiles cleanly with all required tools.