[refactor-opportunist] Extract shared mention-in-issue base action

## 🏗️ Refactor Proposal

**Summary:** Consolidate duplicated `mention-in-issue` composite action logic into a shared base action, with thin permission-specific wrappers.

## Problem
The legacy Claude composite actions repeat nearly identical prompt/execution logic across permission variants, which makes policy updates and prompt fixes drift-prone.

Concrete evidence:
- `claude-workflows/mention-in-issue/rwx/action.yml` and `claude-workflows/mention-in-issue/rwxp/action.yml` were 170 vs 167 lines with **0.938 similarity** (from `git show HEAD:` snapshot comparison).
- The same pattern exists in PR mention variants (`claude-workflows/mention-in-pr/rwx/action.yml` vs `.../rwxp/action.yml`, 307 vs 308 lines, **0.940 similarity**).
- In the issue-mention pair, nearly all sections were duplicated (``, ``, ``, ``, ``, ``, ``, ``, ``, and `claude_args`), with only the `` block differing.

This is a structural maintainability problem (coupled behavior spread across multiple files), not cosmetic formatting.

## Proposed Approach
Introduce a shared implementation action at `claude-workflows/mention-in-issue/base/action.yml` that contains all common behavior and accepts one variant-specific `constraints` input.

Then convert each permission variant action (`rwx`, `rwxp`) into a thin wrapper that:
- preserves the public interface (same inputs/outputs), and
- forwards all common inputs to the base action,
- defines only the variant-specific constraints text.

This keeps behavior centralized while retaining clear permission boundaries.

## Proof of Concept
I partially implemented this refactor on one representative slice to verify viability:

**Files changed:**
- `claude-workflows/mention-in-issue/base/action.yml` (new)
- `claude-workflows/mention-in-issue/rwx/action.yml`
- `claude-workflows/mention-in-issue/rwxp/action.yml`

**Before → After:**
- **Before:** both `rwx` and `rwxp` each embedded full prompt + reaction step + `claude_args` assembly.
- **After:** both wrappers call `uses: ../base` and only define the `constraints` text; shared logic now lives once in `base/action.yml`.

Representative change:
```yaml
# claude-workflows/mention-in-issue/rwx/action.yml
steps:
- name: Run issue mention base action
id: base
uses: ../base
with:
claude-oauth-token: ${{ inputs.claude-oauth-token }}
github-token: ${{ inputs.github-token }}
...
constraints: |
This workflow allows read, write, and execute capabilities but cannot push changes.
```

**Verification:**
- `make lint-actions` ✅ passed (including `rwx`, `rwxp`, and new `base` action files)
- `uv run --extra test pytest tests/ -v` ✅ 71 passed

## Incremental Rollout Plan
This refactor can be completed incrementally:
1. Land the proven `mention-in-issue` base + wrappers (already implemented in this PoC).
2. Apply the same pattern to `claude-workflows/mention-in-pr/{rwx,rwxp}`.
3. Evaluate remaining Claude composite variants for the same consolidation boundary and migrate in small batches.

## Risks and Mitigations
- **Risk 1:** Wrapper-to-base path/reference mistakes could break runtime resolution.
- **Mitigation:** Keep wrappers minimal, validate all composite action manifests in CI (`make lint-actions`), and migrate per-pair.
- **Risk 2:** Subtle prompt behavior drift during extraction.
- **Mitigation:** Move shared prompt text verbatim, isolate only the constraints block as variant-specific, and diff extracted sections during rollout.

## Evidence
- High pre-refactor duplication between permission variants:
- `claude-workflows/mention-in-issue/rwx/action.yml`
- `claude-workflows/mention-in-issue/rwxp/action.yml`
- `claude-workflows/mention-in-pr/rwx/action.yml`
- `claude-workflows/mention-in-pr/rwxp/action.yml`
- New shared implementation and wrappers:
- `claude-workflows/mention-in-issue/base/action.yml`
- `claude-workflows/mention-in-issue/rwx/action.yml`
- `claude-workflows/mention-in-issue/rwxp/action.yml`

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Refactor Opportunist](https://github.com/elastic/ai-github-actions/actions/runs/34854325325)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Start by comparing claude-workflows/mention-in-issue/base/action.yml with its rwx and rwxp wrappers, then review the corresponding mention-in-pr action files. Run make lint-actions and uv run --extra test pytest tests/ -v before and after changes. Done means shared behavior is centralized, wrappers preserve their public interfaces, and the permission variants pass validation without behavior drift.

Written by the indexing model from the issue text.