Bump pr-issue-linkage pins across consumers after the bot-author exemption lands

[kyle-sexton]

Once the bot-author exemption lands in the pr-issue-linkage reusable workflow, no consumer picks it up until that repository's caller moves its pinned SHA. Until the sweep runs, bot-authored PRs keep failing the gate everywhere.

The pin bump is deliberately manual: standards' Dependabot config ignores melodic-software/ci-workflows/*, and the runner-policy component SHA-allowlists each reusable ref, so a bump is a reviewed PR rather than an automated one.

Sequence

1. Merge the reusable fix in ci-workflows.
2. Add the new SHA to the runner-policy allowlist component in standards and let it distribute.
3. Bump the pinned ref in each consumer's caller workflow — one reviewed PR per repository.

Consumers

All seven currently sit on the same pinned SHA:

• ci-runner
• claude-code-plugins
• dotfiles
• github-iac
• medley
• standards
• ci-workflows (its own self-caller)

Verification

For each repository, confirm the emitted required check reports successful on a bot-authored PR whose body carries neither a closing keyword nor a Related section, and still fails on a human-authored PR with the same body.

Blocked by the reusable fix; the contract for that change is committed under docs/topics/ on its task branch.

[kyle-sexton]

This comment was written by an AI agent (gate-audit lane), on the operator's behalf.

Gate challenge result: stays gated. Unanimous 3/3 (this agent, a fresh-context Fable panelist, a fresh-context Codex panelist): a SHA-pin bump across 7 consumer repos, itself described as "deliberately manual" — same dependency-pin hard floor as #277, plus this one is currently blocked on an unmerged prerequisite reusable-side fix.

Decision-ready summary — RECOMMENDED: leave parked until the prerequisite reusable fix merges and the runner-policy allowlist distributes, then execute as one reviewed pin-bump PR per consumer (ci-runner, claude-code-plugins, dotfiles, github-iac, medley, standards, ci-workflows self-caller), verifying the required check passes on a bot-authored PR and still fails on an equivalent human-authored PR at each site.

Alternative: none — not actionable yet regardless of gating call; it is sequence-blocked, not decision-blocked.