feat: Phase 4 — reusable "subscribe" workflow (+ dogfood it) (#8)

Centralizes the consumer stub into a reusable Gitea workflow
(.gitea/workflows/review-reusable.yml, workflow_call + defaulted inputs +
secrets: inherit); gadfly's own dogfood is now a thin caller of it, which
proved end-to-end that github.event context propagates into the reusable
on this act_runner. Adds the slim examples/reusable.yml stub + docs.

Folded in the swarm's findings: timeout_minutes default 30->45, map
GADFLY_API_KEY, explicit permissions block, drop the dead specialist_suite
input, and harden the example's actor gate. ~70 findings graded.

Completes the gadfly-games build (Phases 1-4 + quality fixes).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Steve Dudenhoeffer <steve@stevedudenhoeffer.com>
Co-committed-by: Steve Dudenhoeffer <steve@stevedudenhoeffer.com>

examples/README.md

@@ -6,7 +6,8 @@ set the secrets/vars it references. Gadfly is advisory only — it never blocks
 
 | File | Backend | Needs |
 |------|---------|-------|
-| [`adversarial-review.yml`](adversarial-review.yml) | **Ollama Cloud** (default) + inline notes for every provider | secret `OLLAMA_CLOUD_API_KEY` |
+| [`reusable.yml`](reusable.yml) | **slimmest stub** — calls Gadfly's reusable workflow (`secrets: inherit`); take the defaults or override a few inputs | secret `OLLAMA_CLOUD_API_KEY` |
+| [`adversarial-review.yml`](adversarial-review.yml) | **Ollama Cloud** (default) + inline notes for every provider; full self-contained stub | secret `OLLAMA_CLOUD_API_KEY` |
 | [`local-ollama.yml`](local-ollama.yml) | a **local/LAN Ollama** daemon | nothing (or `GADFLY_BASE_URL` for a remote host) |
 | [`openai-compatible.yml`](openai-compatible.yml) | any **OpenAI-compatible** endpoint (local Ollama `/v1`, gateway, vLLM, OpenRouter…) | `GADFLY_BASE_URL` (+ a key for most gateways) |
 | [`endpoint-aliases.yml`](endpoint-aliases.yml) | **several named backends** at once (one comment each) | repo vars `GADFLY_ENDPOINT_<NAME>` |

examples/reusable.yml

@@ -0,0 +1,50 @@
+# Gadfly — SLIM consumer stub via the reusable workflow.
+# Copy to .gitea/workflows/adversarial-review.yml in your repo.
+#
+# This is the shortest way to subscribe: it calls Gadfly's centralized reusable
+# workflow, which holds the image pin + all the env plumbing. You only declare
+# the triggers, the comment-trigger actor gate, and any overrides you want.
+#
+# Needs: secret OLLAMA_CLOUD_API_KEY (the default Ollama Cloud provider).
+# `secrets: inherit` passes your repo/org/user secrets through to the reusable
+# workflow (GITEA_TOKEN is automatic). Pin @<ref> to a Gadfly tag/branch.
+#
+# Prefer this when you're happy with the defaults. For custom named endpoints
+# (GADFLY_ENDPOINT_<NAME>) or a provider the reusable doesn't map, use the full
+# stub in adversarial-review.yml instead.
+
+name: Adversarial Review (Gadfly)
+
+on:
+  pull_request:
+    types: [opened, reopened, ready_for_review]
+  issue_comment:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_number: { description: "PR number to review", required: true }
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: gadfly-${{ github.event.issue.number || github.event.pull_request.number || github.event.inputs.pr_number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    # Only let your maintainers re-trigger via a PR comment (keep in sync with
+    # the allowed_users override below).
+    if: >-
+      github.event_name != 'issue_comment'
+      || (github.event.issue.pull_request && github.actor == 'your-username')
+    # Pin @<ref> to a Gadfly release tag for stability (@main tracks latest).
+    uses: steve/gadfly/.gitea/workflows/review-reusable.yml@main
+    secrets: inherit
+    with:
+      # All optional — omit to take Gadfly's defaults. Examples:
+      # models: "qwen3-coder:480b-cloud,gpt-oss:120b-cloud"
+      # specialists: "security,correctness,error-handling"
+      allowed_users: "your-username"