chore(deps): update nsheaps + squink github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
nsheaps/agents (changelog)	action	digest	9384e01 → 4dc6f60
nsheaps/ai-mktpl (changelog)	action	digest	0f61088 → 329302c
nsheaps/github-actions (changelog)	action	digest	c1794f6 → 1e12939

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Plugin Version Preview

Preview only — plugin versions and marketplace.json are bumped automatically on merge to main, not in this PR. Manual bumps to higher versions are preserved. See the file annotations for the pending change on each plugin.json.

Plugin	Base	Current	Action
review-utils	0.2.5	0.2.6	Auto-bumped

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

[henry-nsheaps]

✅ Approve — routine Renovate digest bump, no changes needed

• ✅ Six uses: SHA pins bumped by Renovate; 40-char SHA pinning preserved on every hunk
• ✅ Trailing # main sibling comment kept on every @<sha> reference
• ✅ Consistent target SHA across siblings: all nsheaps/github-actions bumps land on 1e12939…, matching Renovate's digest table
• ℹ️ Self-reference on dispatch-review.yaml (base SHA converges post-merge) — see inline note

^{Click to expand full analysis.}

What changed

Renovate chore(deps) digest bump — 7 additions / 7 deletions across 6 workflow / action files, one uses: per file (except apply-repo-settings.yaml which has two). Three upstream repos advance:

Repo	Old digest	New digest	Files touched
nsheaps/github-actions	c1794f6	1e12939	apply-repo-settings.yaml (×2), pr-status-dispatch.yaml, sync-main-to-edge.yaml, sync-plugin-specs.yaml
nsheaps/ai-mktpl	0f61088	329302c	plugins/claude-code/review-utils/actions/run-agent/action.yaml
nsheaps/agents (self)	9384e01	4dc6f60	.github/workflows/dispatch-review.yaml

How I arrived at the scores

Quality 95% — Every edit is a strict SHA-pin replacement on a uses: line; no other lines touched, no whitespace churn, no accidental unpins. Cross-file SHAs for the same upstream repo match (1e12939… used identically in all five nsheaps/github-actions refs), so there's no split-brain risk of two workflows pulling different revisions of the same action.

Security 95% — SHA pinning is preserved everywhere; nothing was downgraded to a mutable ref (@main, @v1, etc.). All three source repos are nsheaps (org-controlled). I did not fetch the upstream diffs to audit what those digests contain — Renovate's auto-merge policy in this repo already predicates on branch protection + status checks, and this reviewer is not gated on upstream code audit. If any of these upstream repos ever holds sensitive tokens (AUTOMATION_GITHUB_APP_PRIVATE_KEY is passed to checkout-as-app and github-app-auth on lines 56 and 44 respectively), a compromise of that upstream repo would matter — but that's a policy concern about the pinning strategy itself, not this diff.

Simplicity 100% — Six line-for-line replacements, nothing added or restructured.

Confidence 95% — Held back from 100% only because I did not diff the three upstream repos to verify the new commits are behavior-compatible; that's out of scope for a mechanical digest review, and Renovate's digest update type does not carry semver signal.

Notable

• Self-reference convergence — dispatch-review.yaml now pins the reusable workflow to 4dc6f60f4666741f60cd93f46f3806d730008e9d, which is this PR's base SHA (chore: bump plugin versions and update marketplace [skip ci] on nsheaps/agents@main, 2026-08-12T19:25:07Z). This is the well-understood Renovate pattern for self-referencing reusable workflows: downstream template consumers who copy this file will call the same commit that this file now lives at once the PR merges. Full note posted inline.
• Base has rolled forward multiple times. Renovate has rebased this PR at least 8 times (each rebase produces a fresh review from me). This is expected behavior for a PR that self-references main; every new main commit triggers a fresh digest and a fresh rebase. Not a defect — it's the intentional trade-off the comment on lines 61–64 spells out ("operators who need pinned stability should replace @main with a commit SHA and update it in lock-step with plugin version bumps").
• PR body accurately reflects the diff — the Renovate-generated change table lists exactly the three repo bumps observed in the files.

Repo-convention adherence

Repo convention here (from the surviving # main sibling comment and the explanatory block-comment at dispatch-review.yaml:61-64) is: pin to full 40-char SHA, keep # main as the "moving target this SHA represents" marker. Every edit in this PR follows that convention exactly.

Follow-ups

None (P0/P1/P2 count: 0).

Recommendation

Approve → let Renovate auto-merge on schedule (the # main-window automerge policy is configured in the PR body).

_{Reviewed by henry-nsheaps · job log}

[henry-nsheaps]

ℹ️ Self-reference: 4dc6f60f4666741f60cd93f46f3806d730008e9d matches this PR's base SHA (chore: bump plugin versions and update marketplace [skip ci] on nsheaps/agents@main, 2026-08-12), so downstream template consumers converge on the same commit the reusable workflow will live at post-merge. Full 40-char SHA pinning and the # main sibling comment are preserved. No action needed.