Update fullsend.yaml workflow SHA to restore review dispatch for bot-authored PRs

What happened

PR #4150 was authored by fullsend-ai-coder[bot] and merged without any automated review. The review agent never dispatched.

The source repo workflow run 30852497254 (triggered by pull_request_target/opened) logged: the Route job evaluated PR_USER_LOGIN: fullsend-ai-coder[bot] against the pull_request_target routing branch, called is_event_actor_authorized which hits the GitHub collaborators API, received "not found" (bot accounts are not collaborators), and set no stage — resulting in "No stage matched -- skipping dispatch."

The fix for this exists upstream: fullsend-ai/fullsend PR #5782 (commit cda3768, merged 2026-07-31) adds a [[ "${PR_USER_LOGIN}" =~ \[bot\]$ ]] carve-out before the permission check. This shipped in v0.33.0.

However, .github/workflows/fullsend.yaml in this repo pins to reusable-dispatch.yml@3cfa255ab4cc8190670585ea42da529119251632 which is v0.32.0 (2026-07-20) — 11 days before the fix landed. This gap has been open since v0.33.0 released on Jul 31, meaning all bot-authored PRs in this repo over the past ~4 days have skipped review dispatch.

What could go better

High confidence: The stale SHA is the direct cause of the review agent not running. The fix exists upstream and this repo simply needs to adopt it.

Impact assessment: For PR #4150 specifically (docs-only, 83 lines added to AGENTS.md), the missing review was low-risk — the human reviewer approved after inspection. However, the same gap applies to all bot-authored PRs, including code changes where automated review provides meaningful value. The prior PR in this pipeline (#4146) required 14 human fix commits after the review agent caught some but not all issues — illustrating that automated review does add value even when imperfect.

Why Renovate hasn't caught up: Renovate handles GitHub Actions SHA updates for this repo (see PR #3866 for the v0.30.0→v0.32.0 bump on Jul 21). The v0.33.0 release is only 4 days old, so Renovate may simply not have scheduled the update yet. However, the gap window means bot-authored PRs are unreviewed in the interim.

Systemic note: Upstream issues fullsend-ai/fullsend #5012 (stale override detection) and #3245 (reconcile script drift detection) aim to catch this class of problem systematically, but they are not yet implemented. Until they are, repos depend on Renovate timing for security/functionality fixes.

Proposed change

Update the pinned SHA in .github/workflows/fullsend.yaml from 3cfa255ab4cc8190670585ea42da529119251632 (v0.32.0) to 6df635a109f4951505ae2d7399e7d52fe15f4518 (v0.33.0) or later. The specific line to change:

# Before
uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@3cfa255ab4cc8190670585ea42da529119251632 # v0.32.0

# After
uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@6df635a109f4951505ae2d7399e7d52fe15f4518 # v0.33.0

If a Renovate PR for this update appears in the interim, merging that PR resolves this issue. The key outcome is adopting a SHA that includes commit cda3768 (the bot carve-out fix).

Validation criteria

After the SHA is updated:

1. The next bot-authored PR (from fullsend-ai-coder[bot]) should trigger a review dispatch — verify by checking the workflow run logs for a dispatch / Review job with conclusion success rather than skipped.
2. The review agent should post review comments or an approval on the PR, confirming end-to-end review dispatch is restored.
3. Sample size: observe the next 3 bot-authored PRs in this repo to confirm consistent review dispatch.

Generated by retro agent from https://github.com/redhat-developer/rhdh-plugins/pull/4150

Open .github/workflows/fullsend.yaml and locate the pinned fullsend reusable workflow SHA. Update it to a SHA that includes commit cda3768, then verify the next bot-authored PR produces a successful dispatch / Review job and review output; observing three such PRs confirms the fix consistently works.