AI code review in CI/CD without prompt injection. Defensive patterns: three security tiers, isolated execution, no secrets in prompts.