A team wants developers to comment @claude on issues and pull requests so Claude Code implements changes and pushes commits. Requirements: the API credential must never appear in the repository, the team's coding conventions must be followed, the workflow must wait for a mention instead of running on every event, and the team's existing CI must run on the commits Claude pushes. Which setup meets all of these?