feat: Phase 4 — reusable "subscribe" workflow (+ dogfood it) (#8)

Centralizes the consumer stub into a reusable Gitea workflow
(.gitea/workflows/review-reusable.yml, workflow_call + defaulted inputs +
secrets: inherit); gadfly's own dogfood is now a thin caller of it, which
proved end-to-end that github.event context propagates into the reusable
on this act_runner. Adds the slim examples/reusable.yml stub + docs.

Folded in the swarm's findings: timeout_minutes default 30->45, map
GADFLY_API_KEY, explicit permissions block, drop the dead specialist_suite
input, and harden the example's actor gate. ~70 findings graded.

Completes the gadfly-games build (Phases 1-4 + quality fixes).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Steve Dudenhoeffer <steve@stevedudenhoeffer.com>
Co-committed-by: Steve Dudenhoeffer <steve@stevedudenhoeffer.com>

.gitea/workflows/review-reusable.yml

@@ -0,0 +1,93 @@
+# Gadfly — REUSABLE adversarial-review workflow (Gitea `workflow_call`).
+#
+# Centralizes the ~90-line consumer stub so a repo can subscribe to Gadfly with
+# a tiny caller. A consumer workflow does:
+#
+#   jobs:
+#     review:
+#       if: ...                      # actor gate for the comment trigger
+#       uses: steve/gadfly/.gitea/workflows/review-reusable.yml@main
+#       secrets: inherit             # passes OLLAMA_CLOUD_API_KEY etc. through
+#       with: { models: "...", allowed_users: "..." }   # all optional
+#
+# Inputs are all optional and default to "" — an empty env value makes the
+# image/entrypoint use its own built-in default, so the caller only sets what it
+# wants to override. Secrets come via `secrets: inherit` (verified working on
+# this Gitea's act_runner); an undefined secret resolves to empty, so optional
+# ones (Claude Code token, foreman endpoints, findings store) are harmless when
+# the consumer hasn't set them.
+#
+# Advisory only — never blocks a merge. The image is pinned to an immutable
+# :sha- tag here (act_runner caches :latest); bump it per Gadfly release.
+
+name: Gadfly review (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      models:                    { type: string, default: "" }   # GADFLY_MODELS (csv)
+      specialists:               { type: string, default: "" }   # GADFLY_SPECIALISTS
+      provider:                  { type: string, default: "" }   # GADFLY_PROVIDER
+      base_url:                  { type: string, default: "" }   # GADFLY_BASE_URL
+      provider_concurrency:      { type: string, default: "" }   # GADFLY_PROVIDER_CONCURRENCY
+      provider_lens_concurrency: { type: string, default: "" }   # GADFLY_PROVIDER_LENS_CONCURRENCY
+      timeout_secs:              { type: string, default: "" }   # GADFLY_TIMEOUT_SECS (per lens)
+      max_steps:                 { type: string, default: "" }   # GADFLY_MAX_STEPS
+      worker_model:              { type: string, default: "" }   # GADFLY_WORKER_MODEL
+      allowed_users:             { type: string, default: "" }   # GADFLY_ALLOWED_USERS
+      trigger_phrase:            { type: string, default: "" }   # GADFLY_TRIGGER_PHRASE
+      # Job wall-clock cap. 45 > 30 as a default: a multi-model swarm or a slow
+      # lens (e.g. claude-code with extended thinking) can exceed 30 minutes.
+      timeout_minutes:           { type: number, default: 45 }
+
+# The reusable job posts the review comment, so it needs issues/PR write. Gitea
+# caps these by the caller's granted permissions; declaring them here is explicit.
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ inputs.timeout_minutes }}
+    steps:
+      - uses: docker://gitea.stevedudenhoeffer.com/steve/gadfly:sha-c342bdb
+        env:
+          # --- event context (from the CALLER's github.*) -------------------
+          GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR: ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }}
+          PR_BRANCH: ${{ github.head_ref }}
+          IS_DRAFT: ${{ github.event.pull_request.draft }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+          ACTOR: ${{ github.actor }}
+          # --- provider auth (via secrets: inherit; empty if consumer unset) -
+          OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          GADFLY_API_KEY: ${{ secrets.GADFLY_API_KEY }}
+          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Common named foreman/LAN endpoints (optional). Consumers with other
+          # GADFLY_ENDPOINT_<NAME>s need the full stub (examples/), since a
+          # reusable workflow can't enumerate arbitrary names.
+          GADFLY_ENDPOINT_M1: ${{ secrets.GADFLY_ENDPOINT_M1 }}
+          GADFLY_ENDPOINT_M5: ${{ secrets.GADFLY_ENDPOINT_M5 }}
+          # --- findings telemetry (optional) --------------------------------
+          GADFLY_FINDINGS_URL: ${{ secrets.GADFLY_FINDINGS_URL }}
+          GADFLY_FINDINGS_TOKEN: ${{ secrets.GADFLY_FINDINGS_TOKEN }}
+          # --- config (from inputs; empty => image default) -----------------
+          GADFLY_MODELS: ${{ inputs.models }}
+          GADFLY_SPECIALISTS: ${{ inputs.specialists }}
+          GADFLY_PROVIDER: ${{ inputs.provider }}
+          GADFLY_BASE_URL: ${{ inputs.base_url }}
+          GADFLY_PROVIDER_CONCURRENCY: ${{ inputs.provider_concurrency }}
+          GADFLY_PROVIDER_LENS_CONCURRENCY: ${{ inputs.provider_lens_concurrency }}
+          GADFLY_TIMEOUT_SECS: ${{ inputs.timeout_secs }}
+          GADFLY_MAX_STEPS: ${{ inputs.max_steps }}
+          GADFLY_WORKER_MODEL: ${{ inputs.worker_model }}
+          GADFLY_ALLOWED_USERS: ${{ inputs.allowed_users }}
+          GADFLY_TRIGGER_PHRASE: ${{ inputs.trigger_phrase }}