ci: bump upstream pins Dependabot cannot see

[gw1-mcp]

Automated upstream-pin check found drift. Review carefully — this is a supply-chain bump, no auto-merge.

GWToolboxpp

ca20ae743551 -> 68055c4df8f8
Review upstream changes: gwdevhub/GWToolboxpp@ca20ae7...68055c4
The plugin build job compiles against this commit, so CI proves it still builds.

mcp-publisher

v1.8.0 -> v1.8.1

Verify these digests by eye against the upstream Sigstore attestation (https://github.com/modelcontextprotocol/registry/releases/download/v1.8.1/mcp-publisher_linux_amd64.tar.gz.sigstore.json):

• amd64: a06c9096dcb9727c13555b6be26c7effa707b01f06a4c561ba7a3635443cf2cc
• arm64: 8dd75a6cf6845688b5d4e46df58d3ca26d5c8d233bb0626606e1db82c5e883e4

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.46%. Comparing base (1b8d8bf) to head (402c7d5).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #38   +/-   ##
=======================================
  Coverage   87.46%   87.46%           
=======================================
  Files          16       16           
  Lines         766      766           
  Branches      227      227           
=======================================
  Hits          670      670           
  Misses          8        8           
  Partials       88       88           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

Merging this PR will not alter performance

✅ 22 untouched benchmarks

---

_{Comparing chore/bump-upstream-pins (402c7d5) with main (1b8d8bf)}