Harden CI image build and add AI code-review job

[maxknv]

Mirrors two upstream changes into silk's CI, adapted to silk's conventions.

Image-build hardening (mirrors ClickHouse/praktika#141)

• Add unattended-upgrades removal and disable the apt-daily/apt-daily-upgrade/unattended-upgrades units in the silk CI dependencies component, before its first apt-get. This stops stock Ubuntu background upgrades from holding the dpkg lock during the image build and, once the AMI is baked, at runner boot. Both commands carry || true so a missing package or transient apt failure never aborts the build.
• Bump image_recipe_version 1.0.11 -> 1.0.12 so a fresh AMI is actually baked with the changed component content.

Note: praktika is consumed here as a pinned wheel, so the upstream fixes to praktika's own gh.py (Pages-root clean) and base _ubuntu_setup_component are not vendored in silk. This applies the same hardening to silk's own Ubuntu setup component instead.

AI code-review job

• New CODE_REVIEW_JOB running praktika review against an OpenAI model on Bedrock, with allow_failure=True (a review hiccup never blocks merge) and enable_gh_auth=True (so it can post its review), wired into the PR workflow.
• New RunnerLabels.SMALL_ARM_BEDROCK label and a dedicated arm-small-bedrock runner pool. Based on silk's existing arm-small pool (keeping the locked-down allow_all_*=False posture and system_logs), plus a scoped bedrock:InvokeModel IAM statement merged into ext["iam_statements"], so only this pool's role can reach the Bedrock model API. General job runners stay Bedrock-less.
• New silk-specific ci/prompts/code_review.md: fiber-scheduler concurrency and lock-free correctness, hot-path performance discipline, and the errno-only error model.

To confirm before merge

• The global.openai.gpt-5.6-sol Bedrock inference profile is reachable from eu-north-1 (Bedrock model availability is region-specific).

[praktika-gh]

Workflow [PR], commit [6257717]

---

Code Review

Result: ✅ No issues found

What changed: Hardens CI image creation against background apt lock contention, bumps the image recipe, and adds a dedicated Bedrock-enabled ARM runner pool. It also adds a non-blocking AI code-review job and repository-specific review guidance to the pull-request workflow.

No issues found. The previously raised apt-service race is addressed by explicitly stopping both active apt services before purging unattended-upgrades.