ci: add AI code review workflow (Claude on Bedrock)

[jam-jee]

What

Adds an automated AI code-review workflow (.github/workflows/ai-code-review.yml) that reviews PRs using anthropics/claude-code-action@v1 running on Amazon Bedrock.

This follows the same pattern already used by other public aws/* repos (e.g. aws/aws-workload-credentials-provider, aws/secrets-store-csi-driver-provider-aws, the Bedrock AgentCore SDKs).

Why Bedrock

• Inference runs in-account via GitHub OIDC — no long-lived Anthropic API key.
• Every InvokeModel call is CloudTrail-audited for cost attribution and security review.

Fork safety

The workflow uses pull_request_target (required to assume the Bedrock role and post comments), so it reuses the existing collaborator gate from pr-checks-master.yml:

• Collaborator PRs → auto-approve environment (runs immediately).
• Fork / external PRs → manual-approval environment (a maintainer must approve the run before any secret or the Bedrock role is exposed).

No new environments are introduced — auto-approve and manual-approval already exist on this repo.

Setup required before this is functional

This PR adds the workflow only. A maintainer must also:

1. Enable Bedrock model access for us.anthropic.claude-opus-4-8 in the CI account/region (us-west-2).
2. Create an OIDC IAM role with bedrock:InvokeModel, trust scoped to repo:aws/sagemaker-python-sdk:*, and store its ARN as the CODE_REVIEW_ROLE secret.
3. COLLAB_CHECK_TOKEN is already used by existing workflows — no change needed.

Notes / open to feedback

• Currently scoped (via paths:) to the sagemaker-train, sagemaker-serve, sagemaker-mlops, and sagemaker-core directories, mirroring pr-checks-master.yml. Remove that block to review every PR.
• Posts as github-actions[bot] via GITHUB_TOKEN. Can switch to a dedicated GitHub App identity if preferred.
• The review prompt is tuned for SDK concerns (public-interface/backward compatibility, credential handling, test coverage) and told to skip lint-enforced nits.

Raised for evaluation — happy to adjust triggers, scope, model, or prompt per maintainer preference.

[jam-jee]

Setup required before this workflow functions

This adds the workflow file only. To make it operational, a maintainer with the appropriate access needs to:

1. Create an IAM role with bedrock:InvokeModel permission for us.anthropic.claude-opus-4-8, with a trust policy federated to GitHub Actions OIDC and scoped to repo:aws/sagemaker-python-sdk:*.
2. Store that role's ARN as the repo Actions secret CODE_REVIEW_ROLE.
3. Ensure Bedrock model access for Opus 4.8 is enabled in the target account/region (us-west-2).

Review quality check

Validated the approach by running claude-code-action's model + review prompt against a real merged PR from this repo (the ECR IAM scoping change, #6024). It correctly assessed the change, reasoned about IAM partition handling, and confirmed test coverage — with no style/lint noise.

Filing for evaluation of the GitHub Actions–based review approach.