ci: bump AI review workflow to v0.3.1

[zhongkechen]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Issue Link, if available

N/A

Description

• Pin the reusable AI PR review workflow to commit d6b017da14385908951d23e26c790b28a4e5f9f0 (v0.3.1).
• Explicitly set run-claude: false so Claude AI review remains disabled.

Demo/Screenshots

N/A

Checklist

• I have filled out every section of the PR template
• I have thoroughly tested this change

Testing

Unit Tests

Not applicable; this only updates workflow configuration.

Integration Tests

Not applicable; the workflow YAML parses successfully and git diff --check passes.

Examples

Not applicable.

[github-actions]

Claude AI review

This PR only touches .github/workflows/ai-pr-review.yml, updating the pinned commit SHA for the reusable aws/aws-durable-execution-ci/.github/workflows/ai-pr-review.yml workflow (to the stated v0.3.1 commit) and adding run-claude: false. It contains no changes to SDK source (sdk/, sdk-testing/, sdk-integration-tests/, otel-plugin/, examples/), so none of the checkpoint-and-replay, retry/callback/invoke, concurrency, serialization, or plugin-lifecycle concerns this review focuses on are implicated.

Observations:

• The YAML edit is syntactically valid: the new run-claude: false key is properly indented under the existing with: block, and the changed uses: line still references a 40‑character hex SHA in the correct owner/repo/.github/workflows/file.yml@sha format.
• Pinning to a full commit SHA (rather than a mutable tag) is the safer practice for a pull_request_target workflow that carries contents: write, id-token: write, and pull-requests: write permissions, and setting run-claude: false matches the stated intent of keeping Claude-based review disabled.
• No test changes accompany this PR, which is appropriate per AGENTS.md/CONTRIBUTING.md since this is workflow-configuration-only and not testable application logic.

Residual risk (not verifiable from this sandbox, no network access): I cannot confirm that d6b017da14385908951d23e26c790b28a4e5f9f0 is actually the commit tagged v0.3.1 in aws/aws-durable-execution-ci, nor that the reusable workflow at that commit accepts a run-claude input. Given this workflow runs with elevated permissions on pull_request_target, it's worth a manual/out-of-band check (e.g., comparing the SHA against the v0.3.1 tag in that repo) before merging, but this is an operational verification step rather than a code defect I can confirm or refute here.

No functional or correctness findings to report.

Reviewed commit 5e7702e509f71cdd827928247d0e8327b9b71027. Workflow run

[github-actions]

Codex AI review

No actionable findings. Residual risk is limited to compatibility with the external reusable workflow at the newly pinned SHA, whose implementation is not present in this checkout.

Reviewed commit 5e7702e509f71cdd827928247d0e8327b9b71027. Workflow run