ci: pin the red-main handler to the release that accepts the App grant and names the culprit

[sylphx-desk-services]

What

Pins the red-main handler caller (and the main-red-gate action, where this repository uses it) to SylphxAI/.github@5150f31.

Why

On the older pin the handler cannot act on a red trunk. In App mode it refuses the revert, because the grant check expects granted and the probe writes granted (App). Its candidate trace also ends as a timeout every time, because the dispatch returns no run id, so it never names the culprit. 5150f31 (SylphxAI/.github#190) fixes both. It is the new pin floor for optimistic-merge conformance.

How it was tested

This is a one-line pin change per file, and the reusable workflow keeps the same inputs and secrets. The main-red-gate action has not changed since the old pin. actionlint reports nothing on the changed lines. The fixed handler is covered by the SylphxAI/.github red-main tests, and its end-to-end run on the sandbox repository is part of this rollout.

[shtse8]

Superseded by #415, which pins the same lines to a later release of the red-main handler (it also retries a candidate dispatch on ref lag).