ci(gadfly): repin to @8adeeea — the old pin's image tag does not exist

The pinned reusable workflow (@c9dab69d) hardcoded
`docker://…/steve/gadfly:sha-b37cd09` into the step URI. That tag was
never pushed to the registry, so every review in this repo failed in
~1s on "failed to resolve reference … not found" — a red workflow that
reads exactly like a review which found nothing (PR #28, run 7056).

@8adeeea runs the reviewer as the job container and resolves its tag per
run — inputs.reviewer_tag then vars.GADFLY_REVIEWER_TAG then the baked
sha-b850e35 — so the hardcoded-dead-tag failure cannot recur, and
retagging the reviewer needs no commit here. Both sha-b850e35 and
sha-8adeeea are present in the registry.

Gadfly config is read from main, so this has to land on main to take
effect for any PR's review.

.gitea/workflows/adversarial-review.yml

@@ -42,7 +42,17 @@ jobs:
     # and cache the reusable-workflow ref, so a moved v1 tag keeps resolving to the
     # stale cached copy. A unique sha forces a cache miss → fresh fetch. Bump this
     # sha to adopt central swarm changes.
-    uses: steve/gadfly/.gitea/workflows/review-reusable.yml@c9dab69d143cb614c1840a5b06d6ffc358f4752d
+    #
+    # NB: the reviewer IMAGE tag is no longer part of this pin. From @8adeeea on,
+    # the reusable workflow resolves it per run as
+    # `inputs.reviewer_tag || vars.GADFLY_REVIEWER_TAG || 'sha-b850e35'`, so
+    # retagging the reviewer is a user-scope variable edit with no commit here.
+    # The previous pin (@c9dab69d) hardcoded `docker://…gadfly:sha-b37cd09`, a tag
+    # that was never pushed to the registry — every review in this repo died in
+    # ~1s on "failed to resolve reference … not found", which reads exactly like a
+    # review that found nothing. Before bumping this pin again, check the tag its
+    # fallback names is really in the registry.
+    uses: steve/gadfly/.gitea/workflows/review-reusable.yml@8adeeeabe0738a797a1bdfc42c5176ea8ee627e4
     # Least privilege: forward only the review secrets (not `secrets: inherit`,
     # which would expose every repo secret). GITEA_TOKEN is the automatic token.
     secrets: