Bump Plumber action to v0.3.86 (security update)

[thomasboni]

Updates the pinned getplumber/plumber action to v0.3.86 (SHA-pinned).

⚠️ Security update — please merge promptly. Details will be disclosed soon.

[cursor]

PR Summary

Low Risk
Single workflow dependency pin with no application or auth logic changes; treat as a timely security-related CI bump per the PR description.

Overview
Pins the Plumber GitHub Action from v0.3.76 to v0.3.86 in .github/workflows/plumber.yml, updating the commit SHA accordingly. The Run Plumber step behavior (score-push: true, checkout, triggers) is unchanged—only the action version.

^{Reviewed by Cursor Bugbot for commit 76605d7. Bugbot is set up for automated code reviews on this repo. Configure here.}