chore: update tend workflows (0.2.6 → 0.2.7)

[dormouse-bot]

Regenerates the eight tend-* workflows against tend 0.2.7 (from 0.2.6). The diff is the version header and the max-sixty/tend/claude@ action pin in each file — no job, permission, trigger, or if: condition changes, and this repo pins no harness model, so nothing in .config/tend.yaml moves.

What the upgrade changes in how the bot behaves here:

• Sessions that use a zsh here-document no longer fail on a read-only scratch path. The sandbox now points here-doc scratch at the writable temp dir (max-sixty/tend#1211).
• tend-review-runs checks open Dependabot alerts as part of its live repository scan, so an unaddressed alert surfaces in the nightly-run review rather than only on the Security tab (max-sixty/tend#1214).
• tend-review-runs re-queries a failing path before reporting it as still red, which removes reports of failures that were already fixed between the run it diagnosed and the sweep (max-sixty/tend#1210).
• tend-review decides its pre-approval check in review_preflight.py rather than in skill prose, making the approve/don't-approve outcome deterministic instead of re-derived per session (max-sixty/tend#1217).
• The always-loaded guidance is smaller, with the long-form material split into references/ files a session reads only when it needs them (max-sixty/tend#1215). Bundled skills are now addressed as /tend-ci-runner:<name> (max-sixty/tend#1216) — this repo's running-tend overlay already uses that form.

Full comparison: max-sixty/tend@0.2.6...0.2.7

No test accompanies this — the change is a generated-file refresh, verified by regenerating with uvx tend@latest init and committing exactly what the generator produced.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	ae5301c
Status:	✅  Deploy successful!
Preview URL:	https://882b473b.mouseterm.pages.dev
Branch Preview URL:	https://tend-update-workflows.mouseterm.pages.dev

View logs

[dormouse-bot]

The regeneration itself checks out clean: eight files, version header and max-sixty/tend/claude@ pin only, .config/tend.yaml untouched (which docs/specs/security-ci.md -> "Upstream compromise" requires of a regeneration commit), and the action's declared input surface is identical between 0.2.6 and 0.2.7, so no with: block or secret goes stale.

One thing the bump leaves behind. docs/specs/security-ci.rationale.md still reads "The checked-in workflows use 0.2.6 as inspected in September 2026" — this PR falsifies that sentence, so the rationale contradicts the files it describes. The 0.2.5 → 0.2.6 bump missed it the same way and needed a separate follow-up commit (0a13f352, "docs(security-ci): bump the inspected-version note to 0.2.6") the next day. I'm pushing the one-line update onto this branch so the note lands with the pin it describes.

Worth a maintainer call, though: that clause has now rotted on two consecutive bumps, and the literal version buys nothing the workflow headers don't already carry — only the 0.1.19 floor in the same sentence is load-bearing, and docs/specs/security-ci.md's FAIL IF is what enforces it. Making the clause version-agnostic ("the checked-in workflows pin a release above that floor") would end the recurrence outright. I kept the literal bump instead, since rewording a security rationale is yours to decide.