docs: update consumer examples to @v3 + Bedrock (no API key) + structured prompts

[sfreudenthaler]

What

Brings the ai-workflows consumer examples (and the README's stale snippets) up to the current v3 standard, and backports the terse structured review prompt that's been proven in dotCMS/core.

Examples (the canonical copy-paste artifacts)

Both examples/consumer-repo-workflow.yml and examples/infrastructure-consumer-workflow.yml:

• Float to @v3 (was @v2.0.0) so consumers track patch releases automatically
• Add Bedrock wiring: model_id: ${{ vars.BEDROCK_MODEL_ID }} + bedrock_role_arn: ${{ vars.BEDROCK_ROLE_ARN }}
• Drop ANTHROPIC_API_KEY secrets blocks — reviews run on Bedrock via the IAM role; the key is vestigial
• Modern terse, structured review prompt — one line per finding, severity + file:line, no essays (mirrors core's .github/prompts/gpt-auto-review.md). The infra example uses the IaC-flavored variant (bugs / security / state & blast radius / cost / IaC conventions).
• The infra example demonstrates the repo-var override pattern: ${{ vars.AI_REVIEW_MODEL_ID || vars.BEDROCK_MODEL_ID }}.

README

• Bumped all orchestrator pins @v1.0.0/@v2.0.0 → @v3
• Added a callout: Bedrock + @v3, no ANTHROPIC_API_KEY required, examples are canonical

Why

The examples are what consuming repos copy. They were 2 majors behind (old @v1/@v2, allowed_tools/direct_prompt input names, required API key) while core/platform/IaC moved to @v3 + Bedrock-via-role + structured prompts. This closes that gap so new consumers start on the current pattern.

Follow-up (not in this PR)

The README still has ~15 stale references in its prose, inputs table, and inline snippets (direct_prompt/allowed_tools multi-line blocks that can't be safely sed-renamed). Left for a focused doc-rewrite rather than half-editing it into broken YAML — the examples are now the authoritative reference.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

🤖 Bedrock Review — qwen.qwen3-next-80b-a3b

New Issues

• 🟠 High: examples/consumer-repo-workflow.yml:49 — secrets: ANTHROPIC_API_KEY removed but no validation or fallback logic for model_id/bedrock_role_arn being unset; if these are missing, the workflow may silently fail or invoke wrong model, causing incorrect or no reviews.
• 🟠 High: examples/infrastructure-consumer-workflow.yml:56 — Same as above: secrets: ANTHROPIC_API_KEY removed without ensuring model_id/bedrock_role_arn are required or validated; unconfigured variables lead to undefined behavior in Bedrock routing.
• 🟡 Medium: README.md:78 — Assumes BEDROCK_MODEL_ID and BEDROCK_ROLE_ARN are set at repo/org level, but no validation or error message if they are missing; failure mode is silent (Assumption: orchestrator workflow requires these vars; What to verify: Does the v3 workflow fail fast if vars are absent?)

Existing

• 🟡 Medium: examples/consumer-repo-workflow.yml:40 — claude_args uses hardcoded tool list; if tools change, this must be updated manually — no abstraction or config-driven tooling (pre-existing, unchanged)
• 🟡 Medium: examples/infrastructure-consumer-workflow.yml:47 — Same as above: hardcoded tool list with no dynamic config (pre-existing, unchanged)

Resolved

• ✅ README.md:64 — @v1.0.0 updated to @v3, aligning with new versioning
• ✅ examples/consumer-repo-workflow.yml:40 — @v2.0.0 updated to @v3, aligning with new versioning
• ✅ examples/infrastructure-consumer-workflow.yml:47 — @v2.0.0 updated to @v3, aligning with new versioning

---

_{Run: #28192959167 · tokens: in: 4862 · out: 592 · total: 5454}