The four refs pointed at fd60e4c9 with a '# main' comment. That comment
names a branch, so Dependabot rendered its bump PR titles as two full
40-character SHAs. Sea-Haven-Industries/.github now publishes tags.
Repoints all four at 2fbfb2e (v1.0.0) and replaces the comment with the
version. Deliberately v1.0.0 rather than the current v1.0.2, so a
Dependabot run has a newer version to find.
* ci: add least-privilege permissions blocks to workflow callers
Resolves code scanning alerts #4 and #5 (actions/missing-workflow-permissions). Both callable workflows only need contents: read; the dependency-review callable already declares it internally, this caps the caller token to match.
* enhance(email): improve detection of allowed Gusto URLs in email classification
Resolves code scanning alert #2
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
