chore: update tend workflows (0.2.14 → 0.2.15)

[cargo-affected-bot]

Regenerates the nine tend-*.yaml workflows against tend 0.2.15 (from 0.2.14). The diff here is the action pin, one setup-uv bump, and one step reordering in tend-mention.yaml; the behavior changes ride in the action itself.

What changes for this repo

• Review conduct on bot-authored PRs. Review bodies now open with a finding rather than with where GitHub already shows the verdict, a follow-up review anchors on what was just pushed while keeping the whole PR in view, and each further fix round on a PR with no human author has to clear a higher bar. All 24 open PRs here are bot-authored, so the last one is the one to watch — it is aimed at exactly this backlog's shape.
• Queue delay now measures the queue. In tend-mention.yaml the "Compute queue delay" step moved ahead of actions/checkout and the setup: step. On this repo setup: does a rustup component add llvm-tools plus a nextest download, so the previously reported delay absorbed that install time; it now reports the wait for the job to start.
• AGENTS.override.md is pinned to base on PR checkouts. It joins CLAUDE.md, AGENTS.md, and the .claude/ and .agents/ trees in the instruction paths restored from the base commit, so a fork PR cannot introduce one that the session then reads as trusted instructions.
• tend check branch protection is stricter. It now requires a restrict-updates ruleset the bot cannot bypass, and tend check --fix creates it. This repo already satisfies it — tend check reports PASS branch-protection:main under 0.2.15, and the one open failure (immutable-releases, tracked in tend check: configuration drift on max-sixty/cargo-affected #117) is unaffected.
• astral-sh/setup-uv v10.1.0 → v10.2.0 in the tend-mention and tend-notifications preflight jobs.

.config/tend.yaml is unchanged: it pins no model, and 0.2.15 does not change the harness model default.

Upstream comparison: max-sixty/tend@0.2.14...0.2.15.

Upstream commits in this range

• fix(review): say where GitHub shows a review's verdict, so the body opens with a finding (fix(review): say where GitHub shows a review's verdict, so the body opens with a finding tend#1362)
• fix(review): raise the bar for each further fix round on a PR with no human author (fix(review): raise the bar for each further fix round on a PR with no human author tend#1366)
• fix(review): focus a follow-up review on what was pushed, with the whole PR in view (fix(review): focus a follow-up review on what was pushed, with the whole PR in view tend#1368)
• fix(mention): compute the queue delay before checkout and setup (fix(mention): compute the queue delay before checkout and setup tend#1365)
• Require a restrict-updates ruleset, pin AGENTS.override.md, and rewrite the security docs (Require a restrict-updates ruleset, pin AGENTS.override.md, and rewrite the security docs tend#1367)
• chore: bump setup-uv to v10.2.0 (chore: bump setup-uv to v10.2.0 tend#1359)

Omitted as having no effect here: the 0.2.15 release commit and its workflow regeneration (max-sixty/tend#1358, max-sixty/tend#1369), tend's repo-local pin bumps (max-sixty/tend#1360), and the token-usage stream-json artifact copy (max-sixty/tend#1361), which was gated to tend's own repository.