chore: harden gitea autofix workflow, ignore dev.bundle

fix-issue/next-issue had unresolved placeholders (<dein Testkommando>,
<owner>/<repo>) and no explicit branch-creation step, so a run that
skipped the CLAUDE.md convention could commit straight to main. Adds a
CI-gate before setting ai-review (actions_run_read against the
existing .gitea/workflows/ci.yml) instead of trusting self-reported
test results, plus a /work-queue command to chain next-issue -> fix-issue.

dev.bundle is Vaadin-regenerated and was tracked+dirty, so every
autofix commit would have swept in unrelated binary diffs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114SVTvBYjLBt3TTxhzJttd

CLAUDE.md

@@ -52,4 +52,5 @@ UI copy/data (chart labels, notifications) is in German.
 - Bei Unklarheit / Scope > ~200 Zeilen Diff: NICHT fixen,
   stattdessen Issue kommentieren ("needs human") und Label `ai-blocked` setzen.
 - PR-Beschreibung MUSS `Closes #<nr>` enthalten.
-- Keine Änderungen an <kritische Pfade, z.B. build config, Migrations> ohne Freigabe.
+- Keine Änderungen an kritischen Pfaden ohne Freigabe: `pom.xml`, `mvnw`/`mvnw.cmd`,
+  `.mvn/`, `.gitea/workflows/`, `.gitignore`.