chore: bump plugin pins to latest release tags

[github-actions]

Automated pin bump (ADR 0049).

bump: portfolio v0.16.0 -> v0.16.1
bump: github v0.7.0 -> v0.7.1
bump: project_board v0.47.0 -> v0.57.1

Merging requires the verify job green — the pin only moves through a passing verification.

This PR was opened with the repository GITHUB_TOKEN, so GitHub holds its verify run for approval (Actions tab -> Approve and run workflows) instead of starting it automatically — the documented explicit-approval contract, see README.md's "Pin-bump PR lifecycle" section (#2645). A later scheduled run updates THIS PR in place rather than opening a new one.

[github-actions]

Pin-bump PR #44 needs a maintainer to approve its verify run — its verify run concluded action_required with no jobs started. GITHUB_TOKEN-authored PRs don't run pull_request workflows automatically; click Approve and run workflows on the Actions tab (https://github.com/protoLabsAI/portfolio-manager-archetype/actions/runs/34092850567). This is the documented explicit-approval step (README.md "Pin-bump PR lifecycle", #2645) — approve it (or close the PR) so the pin doesn't sit unverified.

[protoreview]

QA panel review — PASS

code-review · head 8e777db16ef7 · formal

Low-risk change: a single-line version pin bump (project_board v0.47.0 → v0.49.0 in protoagent.bundle.yaml). All four finders independently confirmed the edit is well-formed and self-contained; no defects were identified. The panel was in full agreement — no disagreements to surface. Verification confirmed the empty findings array; nothing was refuted, qualified, or added. No coverage gaps: the diff touches exactly one line in one file, and that line was read by every finder.

No findings — the review came back clean.

findings JSON (machine-readable)

[]

[protoreview]

QA panel review — PASS

code-review · head 6aa02bcbf3aa · formal

Low-risk change: three version-pin bumps in protoagent.bundle.yaml (portfolio, github, project_board) with no logic changes or cross-file concerns. Nothing to fix first. The panel was unanimous — no findings were raised by any finder, and the verifier confirmed the empty array. The only notable item is the project_board jump (v0.47.0→v0.57.1), which is gated by the verify job per the PR body; standard CI green is sufficient.

No findings — the review came back clean.

findings JSON (machine-readable)

[]