chore: update tend workflows (0.1.12 → 0.1.14)

[dormouse-bot]

Automated nightly regeneration of tend's workflow files. This branch now carries two upstream releases relative to main.

tend version: 0.1.12 → 0.1.14

Notable changes (consumer-relevant only):

• Credential-environment hardening — operational secrets move into a gated deployment environment (Move operational secrets into a gated deployment environment max-sixty/tend#810), the security check now sweeps all credential-holding environments rather than only secret-holding ones (check: sweep credential-holding environments, not just secret-holding ones max-sixty/tend#815), and a job that names an environment while filing a deployment is now refused (workflows: name the environment with deployment: false max-sixty/tend#852, check: refuse a job that names the environment and files a deployment max-sixty/tend#853). This is the source of the new credential-environments check now surfacing in tend check.
• Review correctness — adopter setup runs on the base tree, not the PR's (fix(review): run adopter setup on the base tree, not the PR's max-sixty/tend#806); tend's uv is isolated from the adopter's (fix: isolate tend's uv from the adopter's max-sixty/tend#807); /code-review is ported into a tend-owned skill (fix(review): port /code-review into a tend-owned skill max-sixty/tend#819); synthetic reply containers are ignored in all three review-record guards (fix(review): ignore synthetic reply containers in all three review-record guards max-sixty/tend#835).
• Merge-restriction hardening — an explicit check that the bot cannot bypass the merge restriction (fix: verify the bot cannot bypass the merge restriction max-sixty/tend#795), and the pre-APPROVE guard no longer treats a stale cancellation-cascade FAILURE as red (fix: don't treat stale cancellation-cascade FAILURE as red in pre-APPROVE guard max-sixty/tend#798).
• Triage / mention / notifications robustness — the issue number is substituted into triage PR-body templates (fix(triage): substitute the issue number into the PR-body templates max-sixty/tend#844), bot-engagement counting moved outside jq so --paginate can't split it (fix(mention): count bot engagement outside jq so --paginate can't split it max-sixty/tend#840), and marking a notification read tolerates a transient run-metadata fetch failure (fix(mark-notification-read): tolerate a transient run-metadata fetch failure max-sixty/tend#843).
• Outage reporting — report-failure now names the trigger a stranded outage row points at (fix(report-failure): name the trigger a stranded outage row points at max-sixty/tend#823).

Compare: max-sixty/tend@0.1.12...0.1.14

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	1c80790
Status:	✅  Deploy successful!
Preview URL:	https://3f4fa84f.mouseterm.pages.dev
Branch Preview URL:	https://tend-update-workflows.mouseterm.pages.dev

View logs

[dormouse-bot]

Reviewing my own PR — this is a clean regeneration (version bump 0.1.12 → 0.1.13 across all eight files, plus the tend-mention relay/dispatch rework and the environment: tend job gating from the linked upstream changes), so no code-level concerns. One operational note the maintainer should see, since it isn't visible in the diff:

The tend environment doesn't exist yet, and the two operational secrets are still repo-level. This repo currently has only the security-audit and vscode-extension-publish environments, and TEND_BOT_TOKEN / CLAUDE_CODE_OAUTH_TOKEN are repo-level secrets. So:

• Merging won't break CI. Repository-level secrets stay accessible to jobs that reference an environment, and GitHub auto-provisions the referenced tend environment (with no protection rules) on first run. The workflows keep working exactly as before.
• But the #810 hardening is inert until you finish the setup. The point of environment: tend is to gate the deploy secrets behind a deployment environment. With the secrets still at repo level and the environment unprotected, the environment: tend lines currently add no isolation — any workflow can still reach the tokens. To realize the benefit, move TEND_BOT_TOKEN and CLAUDE_CODE_OAUTH_TOKEN into the tend environment and add a deployment-branch protection rule.
• Caution on how you gate it: use a deployment-branch/tag rule, not a "Required reviewers" rule. Required reviewers pause every job that targets the environment until a human approves the deployment — and the bot can't approve its own, so it would stall every scheduled nightly/weekly/review/triage run behind a manual gate.

Flagging for @nedtwigg to decide — the follow-up is a repo-settings change (environment + secret move), not a code edit, and these files are generated so it can't live in the PR.