[github-actions]

Moves Garrul (KingPin/Garrul) to the upstream release tag.

	ref	commit
from	v2.40.0	9f9b466050c1fa1f92d2c5a82ff48166a9269406
to	v2.41.0	25f81a1ec73591de73aaf0ed88331c1fc27d05f0

Upstream changes: KingPin/Garrul@9f9b466...25f81a1

28 commits:

• Merge pull request #211 from KingPin/release/2.40.0
• chore(deps-dev): bump the dev-minor-patch group with 3 updates
• chore(deps): bump the codeql-action group with 2 updates
• Merge pull request #212 from KingPin/dependabot/npm_and_yarn/dev-minor-patch-f1b22aca86
• Merge pull request #213 from KingPin/dependabot/github_actions/codeql-action-271845e79b
• fix: send same-origin Referrer-Policy on the emailed subscription pages
• Merge pull request #215 from gdecaso/fix/subscribe-referrer-policy
• fix: stop the subscribe pending cap from locking an address out for good
• fix: retire the confirm link once a subscription is cancelled
• refactor: derive the same-origin Referrer-Policy paths from cors.ts
• docs: fix stale line references and index note in subscription routes
• Merge pull request #216 from KingPin/fix/subscription-followups
• chore(release): target v2.40.1
• Merge pull request #217 from KingPin/release/2.40.1
• chore(deps-dev): bump wrangler to 4.156.0 for undici 7.30.1
• Merge pull request #218 from KingPin/chore/wrangler-undici
• chore(release): target v2.40.2
• Merge pull request #219 from KingPin/release/2.40.2
• refactor(spam): move the Clef question and verdict into a shared module
• feat(spam): let operators choose full Clef over Clef-flash
• feat(spam): add a bring-your-own-key decisions provider
• docs(spam): document the decisions provider and where comments go
• docs(spam): name the decisions provider wherever providers are listed
• fix(spam): name the decisions provider in threshold hints and Reset help
• feat(spam): flag a decisions provider with no key on the dashboard
• Merge pull request #220 from KingPin/feat/spam-model-choice-byok
• chore(release): target v2.41.0
• Merge pull request #221 from KingPin/release/2.41.0

The verify workflow packs this pin, checks the artifact's hashes, and installs it into the CI account.

This pull request merges itself. It squash-merges once the required checks pass, the install check included, and the next nightly bump run publishes the new version. The catalog checks that the new release builds, matches its hashes and installs; it does not review upstream's code, and each user decides whether to update. To stop this bump, disable auto-merge here or close the pull request. To have a maintainer merge every bump of this app, set "bump": { "autoMerge": false } in apps/garrul/appflare.jsonc, for example in a commit on this pull request's branch.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}