feat: lazy dev env setup for Claude CI workflow (#17621)

## Summary
- Move build/env/DB setup out of the GitHub Actions workflow into an
on-demand script (`packages/twenty-utils/setup-dev-env.sh`) that Claude
invokes only when needed
- Add Nx/build cache restore/save steps to speed up repeated runs
- Add `allowed_tools` so Claude can run the setup script and common dev
commands (nx, jest, yarn)
- Add `PG_DATABASE_URL` env var via `settings` for the postgres MCP
server
- Remove unnecessary `actions: read` permission grant
- Document the lazy setup pattern in CLAUDE.md

This makes read-only tasks (code review, architecture questions, docs)
fast by skipping the ~2min build/setup overhead, while still letting
Claude run tests and builds when it needs to.

## Test plan
- [ ] Comment `@claude what is the architecture of the backend?` —
should answer fast without running setup
- [ ] Comment `@claude run the twenty-server unit tests` — should call
setup script first, then run tests
- [ ] Verify cross-repo dispatch still works

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.5 <[email protected]>

.github/workflows/claude.yml

@@ -30,7 +30,6 @@ jobs:
       pull-requests: write
       issues: write
       id-token: write
-      actions: read
     services:
       postgres:
         image: postgres:16
@@ -56,25 +55,18 @@ jobs:
           fetch-depth: 0
       - name: Install dependencies
         uses: ./.github/actions/yarn-install
-      - name: Build shared dependencies
-        run: |
-          npx nx build twenty-shared
-          npx nx build twenty-emails
-      - name: Setup env files
-        run: |
-          npx nx reset:env twenty-front
-          npx nx reset:env twenty-server
-      - name: Create databases
-        run: |
-          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
-          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
       - name: Run Claude Code
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          additional_permissions: |
-            actions: read
           claude_args: "--max-turns 50 --model opus"
+          allowed_tools: "Bash(bash packages/twenty-utils/setup-dev-env.sh),Bash(npx nx *),Bash(npx jest *),Bash(yarn *)"
+          settings: |
+            {
+              "env": {
+                "PG_DATABASE_URL": "postgres://postgres:postgres@localhost:5432/default"
+              }
+            }
 
   claude-cross-repo:
     if: github.event_name == 'repository_dispatch'
@@ -104,18 +96,6 @@ jobs:
           fetch-depth: 0
       - name: Install dependencies
         uses: ./.github/actions/yarn-install
-      - name: Build shared dependencies
-        run: |
-          npx nx build twenty-shared
-          npx nx build twenty-emails
-      - name: Setup env files
-        run: |
-          npx nx reset:env twenty-front
-          npx nx reset:env twenty-server
-      - name: Create databases
-        run: |
-          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "default";'
-          PGPASSWORD=postgres psql -h localhost -p 5432 -U postgres -d postgres -c 'CREATE DATABASE "test";'
       - name: Build prompt from dispatch payload
         id: prompt
         uses: actions/github-script@v7
@@ -137,9 +117,14 @@ jobs:
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           prompt: ${{ steps.prompt.outputs.prompt }}
-          additional_permissions: |
-            actions: read
           claude_args: "--max-turns 50 --model opus"
+          allowed_tools: "Bash(bash packages/twenty-utils/setup-dev-env.sh),Bash(npx nx *),Bash(npx jest *),Bash(yarn *)"
+          settings: |
+            {
+              "env": {
+                "PG_DATABASE_URL": "postgres://postgres:postgres@localhost:5432/default"
+              }
+            }
       - name: Post response to source issue
         if: always()
         uses: actions/github-script@v7