add coderabbit.yaml

[mashharuki]

What

add coderabbit.yaml

Why

I previously added it in another branch alongside the Biome setup. Since you requested keeping CodeRabbit in a separate branch, I've created a standalone PR for it.

How

Smoke check

• npm run build passes
• tools/list returns the expected number of tools
• sera.doctor returns overall_ok: true
• If touching the security model: documented threat model in PR body

Notes for reviewers

[douglasgan]

Thanks for splitting this out cleanly, @mashharuki — the .coderabbit.yaml itself is safe (I checked: request_changes_workflow: false, no auto-merge/auto-approve, sensible path filters).

We're holding this one on purpose — and it's not a code issue. Merging it signals adopting the CodeRabbit GitHub App, which then gets read access to all of the org's repo code. That's an org-level decision the maintainers want to make deliberately rather than land via a config file. Once we've signed off on adopting the bot at the org level, this can go straight in as-is.

So: parked pending that call, nothing for you to change. 🙏