ci(autodoc): fix Bedrock OIDC and harden autodoc workflow

Summary

The autodoc workflow (issue_autodoc.yml) was failing at AssumeRoleWithWebIdentity in production with a Not authorized to perform sts:AssumeRoleWithWebIdentity error that never appeared on core-workflow-test. Root cause: the IAM trust policy on GitHubActions-BedrockCodeReview gates on the OIDC job_workflow_ref claim, which only resolves correctly when the job is invoked via a reusable workflow — not when it runs inline.

Changes

• Restructure workflow into a multi-job pipeline: preflight → prep → claude → finalize. The claude job calls dotCMS/ai-workflows/.github/workflows/autodoc-executor.yml as a reusable workflow, ensuring the job_workflow_ref OIDC claim resolves to dotCMS/ai-workflows/...@refs/tags/* and satisfies the Bedrock role trust condition.
• modUser guardrail: skip applying a draft when a human (not the CI Autodoc service account) has an outstanding working draft on the content, to avoid overwriting human edits.
• Pin action SHAs to address Semgrep supply-chain findings.
• Replace secrets: inherit with explicit secret map for least-privilege.
• Move AUTODOC_DOTCMS_SITE_FOLDER and AUTODOC_DOTCMS_BASE_URL from Secrets to Variables — neither is a credential; treating them as secrets obscures config unnecessarily.

Related

• dotCMS/ai-workflows#65 (merged) — introduces autodoc-executor.yml reusable workflow
• Bedrock IAM role: GitHubActions-BedrockCodeReview