chore(deps): protoagent 0.108.0 base + pr-reviewer v0.16.0

[mabry1985]

The base bump is the point of this one.

The fan-out fix finally takes effect

protoAgent#2168 — recipe-declared fan-out width + per-step timings — landed after the v0.107.0 tag. So max_concurrency: 5 in the review recipe has been inert since v0.12.0: the five finders kept running as 4+1 under the host's default cap of 4, paying the slowest finder's cost twice while the second wave ran a single step alone and saved nothing.

Measured over 60 reviews before the fix:

code-review-structural (5 finders)  n=53  p50 458s      F + T = 322
code-review            (4 finders)  n=7   p50 322s  →  2F + T = 458
                                              →  F ≈ 136s,  T ≈ 186s

Expected saving: ~136s per structural review, about 30%.

And step_s starts flowing

Every review so far recorded step_s: null and slowest_step: null, because the timings come from the engine change in the same PR. The split above is an estimate inferred from two recipe populations; after this it is measured.

That matters for what comes next: the sequential tail (synthesize → verify → report, ~186s) is now the larger half, and synthesize is close to a no-op when there's one finding. But optimising it before the numbers exist is how you make something slower while believing otherwise.

Plugin v0.14.1 → v0.16.0

version	what
v0.14.2	Grounding no longer mistakes prose for a code quote — it downgraded a true finding on projectBoard-plugin#94 within an hour of deploying
v0.15.0	@vera review — on-demand panel, admin-gated, permission resolved server-side (#28 slice 1)
v0.16.0	Every guard reports its decision, not only when it fires; and a finding with line: 0 no longer silently blocks convergence forever

The observability one is worth calling out: four rules now sit between the panel's findings and the merge gate, and three of them were only visible when they acted — so "ran and correctly declined" was indistinguishable from "never ran". Twice that meant verifying a guard by hand-fetching blobs from GitHub.

Verification

Base and verified_against moved together (they must stay in step). Upstream main green at 260 tests; v0.16.0 tagged.

Merging deploys — GHCR rebuild then watchtower rolls Vera in ~60s.

🤖 Generated with Claude Code