chore: update tend workflows (0.2.5 → 0.2.6)

[dormouse-bot]

Regenerates the tend workflows from tend 0.2.6 (was 0.2.5). The only generated change beyond the version stamps and the max-sixty/tend/claude@ action pin is in tend-mention.yaml's verify script.

A review the bot leaves on its own PR no longer dispatches a second session. Until now, a pull_request_review authored by the bot on a PR authored by the bot dispatched a "participation" run whenever the review carried a body or fresh inline comments — so the review run posted findings and a mention run then booted to act on them. Upstream moved that work into the review session itself (max-sixty/tend#1203), so the dispatch is now refused outright. Naming @dormouse-bot inside a review still summons a session: the mention checks run ahead of this refusal. Reviews from humans, and reviews on PRs the bot didn't author, are unaffected.

Two fixes land in the harness rather than the generated YAML. The CI sandbox now gets a writable temp directory (max-sixty/tend#1199) — this nightly run hit exactly that, with /tmp read-only and every scratch path rerouted by hand. And the bundled skills' description of author_association is corrected to say the field is nested rather than absent (max-sixty/tend#1178), which is what the maintainer-tier gate reads before acting on a directive.

Full comparison: 0.2.5...0.2.6

.config/tend.yaml is unchanged — this repo pins no harness model, so there was nothing to re-point at a newer default.

Alongside the regen, docs/specs/security-ci.rationale.md gets its inspected-version note moved from 0.2.5 to 0.2.6 so it matches the pin these workflows now carry; the 0.1.19 security floor in that sentence is unchanged.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	0a13f35
Status:	✅  Deploy successful!
Preview URL:	https://864f9b15.mouseterm.pages.dev
Branch Preview URL:	https://tend-update-workflows.mouseterm.pages.dev

View logs

[dormouse-bot]

Feedback on work in progress — not a merge verdict. Mark ready when you want the full review.

One thing to land with the bump: docs/specs/security-ci.rationale.md still reads "The checked-in workflows use 0.2.5 as inspected in September 2026" under the 0.1.18 gap heading. After this PR the workflows pin 0.2.6, so the note contradicts the files in the same month it claims to describe. Bumping it alongside the regen is the established pattern here — commit 1d2c139 ("docs(security-ci): fork PR trees now land in the harness clone") did exactly that for the 0.2.5 bump. The 0.1.19 security floor in the same sentence is unaffected. The line is outside this PR's diff, so it can't be applied as an inline suggestion.

[dormouse-bot]

Applied in 0a13f35: the 0.1.18 gap note in docs/specs/security-ci.rationale.md now reads 0.2.6, matching the max-sixty/tend/claude@0.2.6 pin this PR lands. The 0.1.19 security floor in the same sentence is untouched, and pnpm lint:specs passes (33 specs, 65 files) — rationale files carry no word budget, so the one-word swap needed no re-baseline.

A repo-wide grep turned up no other stale 0.2.5 reference: the remaining hits are an unrelated minimatch@10.2.5 in pnpm-lock.yaml and three Cargo dependency versions in website/src/data/dependencies-cargo.json.