deploy(vera): github-plugin v0.7.0 → v0.7.1, pr-reviewer v0.38.0 → v0.39.0

[mabry1985]

Bumps Vera's plugin pins to the releases that stop her reviewing blind:

• github-plugin v0.7.0 → v0.7.1. The contents reads are GETs (fix(read): contents reads must be GETs — -f ref= made gh send POST, a 404 github-plugin#29). Passing -f ref= made gh api send a POST, which returns 404 on /contents. So every ref-pinned file read failed, and the review lanes reviewed diffs blind (Repository file reads return 404 during panel review, forcing lanes to review diffs blind pr-reviewer-plugin#118).
• pr-reviewer v0.38.0 → v0.39.0.
  • A blind or broken finder can't read as a clean pass (#120, #122).
  • An absent findings payload never posts PASS.
  • A degraded lane caps PASS at WARN.
  • The structural lane's turn budget survives the host's step accounting (#121, #119). At 4, it hard-stopped on every run since 09-12.

The two ship together. v0.39.0's finder prompts pass ref= on every file read, and that only works with v0.7.1's GET fix.

This bumps all three places the pins live, as #51 did: protoagent.bundle.yaml (which docker-publish reads), the Dockerfile's ARG defaults, and the README table (which CI asserts). Core stays at its current version.

After merge, docker-publish builds vera:latest. The deploy is then docker compose pull vera && docker compose up -d vera in homelab-iac/stacks/vera on ava.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LSRkzcPyaDrKSY7geFuGr3

[protoreview]

QA panel review — PASS

code-review-structural · head 34863b9cfe1f · formal

No findings were raised by any review-finder on this PR, and the structural verification pass confirmed an empty array — there is nothing to verify, re-rank, or carry forward. Overall risk is low on the evidence available, but this is a clean bill of health by absence rather than by positive confirmation: the panel found no defects, not that it confirmed correctness. No fix-first item. No panel disagreement. No prior requests to disposition. Gap: the structural pass (code-review-structural:verify) ran as a no-op because it received an empty findings list; it did not independently inspect the diff for structural issues (e.g., missing type annotations, unhandled exception paths, or API contract violations) — it can only verify what the finders flag. If this PR touches public API surfaces or concurrency-sensitive code, consider a targeted structural pass with explicit scope.

No findings — the review came back clean.

findings JSON (machine-readable)

[]