ci: configure AI pull request reviews

[boh5]

Summary

• configure CodeRabbit as the concise, general-purpose PR reviewer
• configure Cubic as the architecture-focused reviewer for ArchCode
• keep both reviewers non-blocking and disable automated approvals and code mutations
• avoid duplicate PR descriptions and ignore generated output

Validation

• parsed both files with Bun's YAML parser
• validated .coderabbit.yaml against CodeRabbit's official JSON Schema
• validated cubic.yaml against Cubic's official JSON Schema
• confirmed GitHub CodeQL default setup is configured

Expected result

This PR serves as the first integration test for CodeRabbit, Cubic, and CodeQL. Existing CI remains the deterministic merge gate.

---

Summary by cubic

Configures automated PR reviews with CodeRabbit for concise general checks and Cubic for architecture-focused review. Both are non-blocking with no auto-approvals or code changes; existing CI and CodeQL remain the merge gate.

• New Features
  • Add .coderabbit.yaml: auto reviews with high-level summaries, ignores bun.lock and **/dist/**, respects skip-ai-review, disables docstring/test/autofix/CI/merge-conflict actions.
  • Add cubic.yaml: enables architecture checks with custom rules tied to AGENTS.md (boundaries, session lifecycle, tool output security with broadened coverage), ignores bun.lock, dist/**, and apps/web/dist/**, disables auto-approve and PR description generation, resolves threads when addressed.

^{Written for commit d033593. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Added repository configuration for automated CodeRabbit and Cubic reviews.
  • Enabled concise, security- and regression-focused review summaries and review status.
  • Set up review exclusions, incremental review behavior, and manual approval requirements.
  • Added architecture and tool-output security rules for key project areas.
  • Disabled automated finishing touches such as docstrings, unit test generation, autofix, and CI/merge-conflict related updates.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds .coderabbit.yaml and cubic.yaml configurations for automated review behavior, repository exclusions, architecture and security rules, and disabled automated finishing or approval actions.

Changes

Review automation

Layer / File(s)	Summary
CodeRabbit review behavior .coderabbit.yaml	Configures concise English reviews, review output controls, path exclusions, incremental automated reviews, label-based opt-out, disabled finishing actions, and chat auto-replies.
Cubic repository policies cubic.yaml	Configures review sensitivity and lifecycle behavior, ignore rules, large-change limits, architecture and security rules, and disabled PR automation features.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding CI configuration for AI pull request reviews.

---

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>