chore(deps): update nsheaps + squink github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
nsheaps/agents (changelog)	action	digest	9384e01 → d12d9c3
nsheaps/ai-mktpl (changelog)	action	digest	0f61088 → ae4b628
nsheaps/github-actions (changelog)	action	digest	c1794f6 → 1e12939

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Plugin Version Preview

Preview only — plugin versions and marketplace.json are bumped automatically on merge to main, not in this PR. Manual bumps to higher versions are preserved. See the file annotations for the pending change on each plugin.json.

Plugin	Base	Current	Action
review-utils	0.2.3	0.2.4	Auto-bumped

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

[henry-nsheaps]

✅ Approve — routine Renovate digest bump, no changes needed

• ✅ Seven uses: SHA pins bumped by Renovate across three internal nsheaps/* packages; full 40-char SHA pinning preserved on every line
• ✅ Trailing # main sibling comments preserved on all seven lines
• ✅ No functional/behavioral change; only the pinned digest values change
• ℹ️ Re-review vs. my prior (now-minimized) reviews: scope grew — Renovate rebased and now bundles the nsheaps/github-actions bump (c1794f6 → 1e12939, 4 uses: sites across 4 workflow files) alongside the previously-reviewed nsheaps/agents and nsheaps/ai-mktpl bumps. All three targets advanced to newer SHAs; verdict unchanged

Click to expand for full details

Scope

Seven-line change across six files, all uses: pin bumps generated by renovate[bot] (head SHA 1f263de1878f61009fdbacdeb3ca27002eff938a):

File	Line	Action	Old → New
.github/workflows/apply-repo-settings.yaml	56	nsheaps/github-actions/.github/actions/checkout-as-app	c1794f6 → 1e12939
.github/workflows/apply-repo-settings.yaml	63	nsheaps/github-actions/.github/actions/apply-repo-settings	c1794f6 → 1e12939
.github/workflows/dispatch-review.yaml	68	nsheaps/agents/.github/workflows/review-dispatch.yaml	9384e01 → d12d9c3
.github/workflows/pr-status-dispatch.yaml	44	nsheaps/github-actions/.github/actions/github-app-auth	c1794f6 → 1e12939
.github/workflows/sync-main-to-edge.yaml	22	nsheaps/github-actions/.github/workflows/sync-main-to-edge.yaml	c1794f6 → 1e12939
.github/workflows/sync-plugin-specs.yaml	20	nsheaps/github-actions/.github/workflows/sync-plugin-specs.yaml	c1794f6 → 1e12939
plugins/claude-code/review-utils/actions/run-agent/action.yaml	228	nsheaps/ai-mktpl/.github/actions/interpolate-prompt	0f61088 → ae4b628

The nsheaps/agents self-reference advances to the current tip of main in this repo (d12d9c3, which is also this PR's base SHA), so downstream template consumers converge on the same commit the reusable workflow lives at post-merge. The nsheaps/github-actions and nsheaps/ai-mktpl bumps advance sibling internal actions.

How I arrived at the assessment

• Correctness: All seven diffs replace exactly the 40-char commit SHA in a uses: line; nothing else in any line or file changes. The # main sibling comment is retained on every line, so the annotation still matches the pinned ref's origin branch. Verified by re-reading the diff at head SHA 1f263de1878f61009fdbacdeb3ca27002eff938a — all seven lines match exactly.
• Security: Full 40-char commit SHA pinning is retained on every line — the recommended posture per GitHub's hardening guide for third-party actions. All three targets are internal nsheaps/* repos advanced deterministically by Renovate; risk is bounded to the contents of the target commits, which have their own review history on merge.
• Simplicity / Maintainability: The surrounding block comment in dispatch-review.yaml (lines 62–66) explicitly documents this pattern ("operators who need pinned stability should replace @main with a commit SHA and update it in lock-step with plugin version bumps"), so this bump matches the intended workflow. The same reasoning applies uniformly to the newly-bundled nsheaps/github-actions sites.
• Test coverage / Docs: No source, config, docs, or test surface is affected beyond the seven pin values themselves — nothing to add.
• PR description accuracy: The Renovate PR body's table lists all three packages with their short SHAs (9384e01→d12d9c3, 0f61088→ae4b628, c1794f6→1e12939); matches the diff exactly. The body's warning that "Some dependencies could not be looked up" is a known Renovate quirk referencing the Dependency Dashboard (issue #107), not a blocker for this PR.
• Repo conventions: No CLAUDE.md/AGENTS.md conventions conflict with SHA bumps on uses: lines.

Verification of target commits

• nsheaps/agents@d12d9c3e241dfa111c4e0430edbda0ab62bef951 = chore: release v0.3.131 [skip ci] (2026-08-12, automation-nsheaps[bot]); confirmed to equal this PR's base SHA
• nsheaps/github-actions@1e129396b6f0b39257efac9a255010fe64a68ef8 = Fix sync-plugin-specs workflow self-triggering with no plugins/ (#120) (2026-08-12, Nathan Heaps) — substantive fix, carries its own on-merge PR review
• nsheaps/ai-mktpl@ae4b628c231a4b272d4dece81f4c24b812d0308b = fix: add ref key and mise-install hook for github-app (#744) (2026-08-12, Nathan Heaps) — substantive fix, carries its own on-merge PR review

Notes / non-blockers

• I did not read the full diff of every target commit — that's implicitly trusted via the internal Renovate configuration for nsheaps/* repos and the on-merge review history of each target commit. If any bump surfaces a behavior change after merge, it belongs to the target commit's own review, not to this PR.

Follow-ups:

None.

---

References:

• Workflow run: https://github.com/nsheaps/.ai-agent-henry/actions/runs/31561255470
• GitHub Actions hardening (SHA pinning): https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

[henry-nsheaps]

ℹ️ Self-reference: d12d9c3e241dfa111c4e0430edbda0ab62bef951 matches this PR's base SHA (chore: release v0.3.131 [skip ci] on nsheaps/agents@main), so downstream template consumers converge on the same commit the reusable workflow will live at post-merge. Full 40-char SHA pinning and the # main sibling comment are preserved. No action needed.