[github-actions]

Automated pin bump (ADR 0049).

bump: project_board v0.72.0 -> v0.74.0
bump: github v0.9.3 -> v0.10.1

Merging requires the verify job green — the pin only moves through a passing verification.

[protoreview]

QA panel review — PASS

code-review · head 478235b5ac07 · formal

Low-risk change: a single minor cross-file inconsistency between the README's pin list and the manifest. The README was already stale before this PR (v0.65.0/v0.9.1 vs. manifest's v0.72.0/v0.9.3) and is now further out of date (manifest now at v0.74.0/v0.10.1). Fix-first: update the README pin list to match the manifest. No panel disagreement; the verifier confirmed the finding as accurate and correctly scoped. No coverage gaps — the diff is small and the single finding accounts for the only cross-file inconsistency identified.

Findings

	Severity	Location	Finding	Verified
🟡	minor	README.md:26	The README's pin list contradicts the actual pins in protoagent.bundle.yaml; it was already stale before this PR and is now further out of date.	confirmed

findings JSON (machine-readable)

[
  {
    "file": "README.md",
    "line": 26,
    "severity": "minor",
    "category": "cross-file",
    "claim": "The README's pin list contradicts the actual pins in protoagent.bundle.yaml; it was already stale before this PR and is now further out of date.",
    "evidence": "README.md line 26: 'Pins: project_board v0.65.0, agent_browser v0.6.4, github v0.9.1 (verified against core 0.200.0).' \u2014 but the manifest now pins project_board at v0.74.0 and github at v0.10.1.",
    "verdict": "confirmed",
    "note": "README says v0.65.0/v0.9.1; manifest was v0.72.0/v0.9.3 before this PR (already stale) and is v0.74.0/v0.10.1 after. Both verified at PR head."
  }
]

---

1 finding(s) excluded from the verdict by in-diff confinement (file not among this PR's changed paths):

• README.md (minor) — The README's pin list contradicts the actual pins in protoagent.bundle.yaml; it was already stale before this PR and is now further out of date.