Add hardened @claude GitHub App workflow (blocked on App installation)

### Context

Part of a multi-repo rollout of the `@claude` GitHub Actions workflow across futuroptimist's projects (sugarkube, jobbot3000, token.place, danielsmith.io, gitshelves, f2clipboard, axel, sigma, pr-reaper, gabriel, wove, futuroptimist, aquiloop all now have it). This repo is the last one on the list and is currently blocked.

### Blocker: the Claude GitHub App isn't installed on this org

Checked via `gh api orgs/democratizedspace/installations` — only 3 apps are installed on the `democratizedspace` org: `chatgpt-codex-connector`, `codecov`, and `greptile-apps`. The Claude GitHub App (https://github.com/apps/claude) is not among them, so no `@claude` webhook events would be delivered here even with a workflow file in place.

**Action needed (requires interactive OAuth authorization, can't be done via API):** an org admin needs to visit https://github.com/apps/claude and install/configure it for the `democratizedspace` org (or at minimum this `dspace` repo).

### Once the App is installed, remaining work

Add `.github/workflows/claude.yml` + `.github/scripts/claude-validate.sh`, following the pattern proven out across the other repos: an `authorize` job restricting triggers to a trusted-actor allowlist and rejecting fork PRs, a credential-less `claude-validation` job that independently runs this repo's real checks, and a sandboxed `claude` job with no general Bash access (only the locked-down wrapper script).

This repo's toolchain is npm-based with Helm charts (see `ci-helm.yml`/`ci-image.yml`), so the wrapper will need repo-specific tailoring rather than reusing another repo's script verbatim.

Also needed: an `ANTHROPIC_API_KEY` repository secret with billing credit (this repo currently has `CODECOV_TOKEN` and `GHCR_TOKEN`, but no Anthropic credential).

### Checklist

- [ ] Install the Claude GitHub App on the `democratizedspace` org / `dspace` repo
- [ ] Add `ANTHROPIC_API_KEY` repository secret (with billing credit)
- [ ] Add `.github/workflows/claude.yml` + `.github/scripts/claude-validate.sh` tailored to this repo's npm/Helm toolchain
- [ ] Verify end-to-end with a real `@claude` test comment

First verify the Claude GitHub App installation with the documented gh api orgs/democratizedspace/installations check. Then study ci-helm.yml and ci-image.yml, and add .github/workflows/claude.yml plus .github/scripts/claude-validate.sh for the npm/Helm toolchain. Done means the app and ANTHROPIC_API_KEY are configured, authorization and validation jobs are hardened, and a real @claude comment completes successfully.

Written by the indexing model from the issue text.