chore: bump umm-actually to v0.4.7

[aliasunder]

Summary

• Bump umm-actually from v0.4.6 to v0.4.7 (SHA 9c9353c)
• Wire new conventions_budget_tokens input to vars.UMM_CONVENTIONS_BUDGET_TOKENS — controls the token budget for the conventions file section (default 8000; empty = 8000)

What changed in v0.4.7

• conventions_budget_tokens input: configurable token budget for the conventions file section of the review prompt (replaces the hardcoded 8000-token cap)
• Empty-string default safety for the new input (mirrors the existing request_timeout_seconds pattern)
• Inlined single-use schema helper per decomposition convention
• buildUserPrompt custom-budget test coverage
• README typo fix (permission-checks → checks)

[umm-actually]

Add issue.pull_request to the concurrency noop condition
Low severity · ci · high confidence

.github/workflows/umm_review.yml:20 — beyond the diff's line ranges, in code the changes touch or depend on.

Pre-existing: the workflow comment claims the concurrency noop condition “mirrors both legs of the job guard,” but its issue_comment branch omits the guard's github.event.issue.pull_request check. An owner comment starting with exactly @umm review on a plain issue shares its number space with PRs, so the run gets the same group as the same-numbered PR's review run and cancel-in-progress: true cancels that in-flight review — even though the job then skips (no issue.pull_request). This is precisely the guard-failing-run-cancels-live-review failure the noop suffix exists to prevent.

Failure scenario: While PR #42's review run is in flight (concurrency group umm-review-42), the owner posts @umm review on plain issue #42 (not the PR). The new issue_comment run's group evaluates to umm-review-42 with no -noop-<run_id> suffix, so the new run cancels the in-flight review; the job guard then skips the new run because github.event.issue.pull_request is absent, leaving PR #42 without a review.

Suggested fix

Add the guard's missing check inside the negation so the issue_comment branch reads `!(github.event.issue.pull_request && github.event.comment.user.login == github.repository_owner && startsWith(github.event.comment.body, '@umm review'))`, matching the job `if` exactly.

---

umm-actually · deepseek/deepseek-v4-flash-0731

[umm-actually]

umm-actually re-reviewed at bb694dd

No new findings (1 tracked finding(s) across all runs).

---

umm-actually · deepseek/deepseek-v4-flash-0731