fix: address AI review findings for CI pipeline and duplicate detection

- Fix anti-pattern regex 2 to match quoted form '"$CI_STATE" != "success"'
  (was r'\$CI_STATE\s*!=\s*"success"', now r'"?\$CI_STATE"?\s*!=\s*"success"')
- Update both anti-pattern messages to say 'extract ci_passed() to lib/'
  instead of implying it already exists as a shared helper in dev-poll.sh
- Add explicit 'when: event: [push, pull_request]' trigger block to ci.yml
- Add '-r' to xargs in shellcheck step to handle zero .sh files gracefully
- Fix operator precedence bug in review-poll.sh:62: scope the OR clause
  with braces so CI_STATE=pending bypass only applies when WOODPECKER_REPO_ID=0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.woodpecker/ci.yml

@@ -5,11 +5,14 @@
 #   1. shellcheck   — lint all .sh files (warnings+errors)
 #   2. duplicate-detection — report copy-pasted code blocks (non-blocking)
 
+when:
+  event: [push, pull_request]
+
 steps:
   - name: shellcheck
     image: koalaman/shellcheck-alpine:stable
     commands:
-      - find . -name "*.sh" -not -path "./.git/*" -print0 | xargs -0 shellcheck --severity=warning
+      - find . -name "*.sh" -not -path "./.git/*" -print0 | xargs -0 -r shellcheck --severity=warning
 
   - name: duplicate-detection
     image: python:3-alpine