ci: bump umm-actually to v0.3.14

[aliasunder]

Catches the review workflow up to the current release. The workflow landed pinned at v0.3.11; the other consumers are on v0.3.14, which since v0.3.11 adds the authoritative per-attempt request deadline (default 900s), the unknown-file finding filter, exclude_paths, and priority-doc budget/visibility fixes.

🤖 Generated with Claude Code

[umm-actually]

Update the request_timeout_seconds default to 900s
Low severity · correctness · high confidence

.github/workflows/umm_review.yml:96 — beyond the diff's line ranges, in code the changes touch or depend on.

The workflow comment says request_timeout_seconds defaults to 600s (empty var) but the pinned v0.3.14 adds the per-attempt deadline with a default of 900s per the PR description. The pinned action and the comment now disagree, so any operator reading the workflow gets a stale default.

Failure scenario: An operator leaves UMM_REQUEST_TIMEOUT_SECONDS unset (the default), relies on the documented 600s cap, and observes each model attempt now running up to 900s before the retry/fallback ladder advances — the documented value no longer matches the configured behavior, leading to wrong timeout budget and prolonged CI runs.

Suggested fix

Change the 'Empty = 600' comment to 'Empty = 900' (or drop the number and refer to the action's v0.3.14 default). Verify against the action's actual defaults for any other inputs whose comments could be stale.

---

umm-actually · deepseek/deepseek-v4-flash-0731

[umm-actually]

Add umm_review.yml to the workflow structure docs
Low severity · correctness · medium confidence

README.md:25 — beyond the diff's line ranges, in code the changes touch or depend on.

Pre-existing: the structure trees in README.md and AGENTS.md list only auto_release.yml and manual_release.yml under .github/workflows/ and describe the directory as release automation, omitting umm_review.yml — a secret-bearing workflow that runs on every owner PR and comment trigger. The docs' tree implies the review workflow does not exist, which is a stale description of the current repo.

Failure scenario: A reader or an AI agent navigating by the documented structure looks for how the repo's review automation is configured, finds no mention of a review workflow, and cannot see that PR-triggered, secrets-bearing workflow before it runs — e.g., auditing the repo's CI surface and missing the only workflow that posts PR comments and runs the OpenRouter key.

Suggested fix

Add a bullet to the structure section, e.g. `.github/workflows/umm_review.yml — automated PR review (umm-actually bot)`, and update README.md's .github/workflows line accordingly. (Also in AGENTS.md's structure tree.)

---

umm-actually · deepseek/deepseek-v4-flash-0731

[umm-actually]

umm-actually reviewed at eb06603

2 new finding(s) posted (2 tracked finding(s) across all runs).

---

umm-actually · deepseek/deepseek-v4-flash-0731