chore(deps): update nsheaps + squink github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
nsheaps/agents (changelog)	action	digest	9384e01 → e430440
nsheaps/ai-mktpl (changelog)	action	digest	329302c → 8bcd014
nsheaps/github-actions (changelog)	action	digest	c1794f6 → 1e12939

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Plugin Version Preview

Preview only — plugin versions and marketplace.json are bumped automatically on merge to main, not in this PR. Manual bumps to higher versions are preserved. See the file annotations for the pending change on each plugin.json.

Plugin	Base	Current	Action
review-utils	0.2.6	0.2.7	Auto-bumped

[henry-nsheaps]

✅ Approve — routine SHA bumps, all pins verified on main

• ✅ All 3 new SHAs are reachable from main on their source repos (identical to main head at review time)
• ✅ All 3 old→new bumps are strictly ahead-only (no rewinds)
• ✅ SHA-pin discipline preserved; # main trailing comments kept on every line
• ✅ No callsite input/secret changes required by the bumped refs
• ✅ Fully mechanical 6-file diff, each hunk is a single-line SHA replacement

Click to expand for full details

Scope

6 files, +7/-7 lines. Every hunk is a one-line SHA replacement on an already-pinned uses: reference. No inputs, outputs, permissions, secrets, triggers, or job structure changed at the callsites.

File	Bumped ref
.github/workflows/apply-repo-settings.yaml (×2)	nsheaps/github-actions/.github/actions/{checkout-as-app,apply-repo-settings}
.github/workflows/dispatch-review.yaml	nsheaps/agents/.github/workflows/review-dispatch.yaml
.github/workflows/pr-status-dispatch.yaml	nsheaps/github-actions/.github/actions/github-app-auth
.github/workflows/sync-main-to-edge.yaml	nsheaps/github-actions/.github/workflows/sync-main-to-edge.yaml
.github/workflows/sync-plugin-specs.yaml	nsheaps/github-actions/.github/workflows/sync-plugin-specs.yaml
plugins/claude-code/review-utils/actions/run-agent/action.yaml	nsheaps/ai-mktpl/.github/actions/interpolate-prompt

Verification performed

Using the GitHub API against each source repo:

1. SHA existence + main-reachability (all three compare calls returned status: "identical", ahead_by: 0, behind_by: 0 against main):
   • nsheaps/github-actions → 1e12939... ✅
   • nsheaps/agents → e430440... ✅
   • nsheaps/ai-mktpl → 8bcd014... ✅
2. Ahead-only bumps — each compare(old...new) returned ahead_by > 0, behind_by: 0 (no rewind):
   • github-actions: 1 commit ahead — a single fix ("Fix sync-plugin-specs workflow self-triggering with no plugins/") touching only .github/workflows/sync-plugin-specs.yaml upstream.
   • agents: 60 commits ahead, spanning release tags v0.3.116 → v0.3.135. The functionally-notable ones relevant to the review-utils runtime consumed here are #322, #327, #331, #334, #340, and #333 (metrics-file permissions, receiver hang fix, COMMENT-blocks-required-checks fix, Read in dispatch allowedTools, label-removal at review-start).
   • ai-mktpl: 25 commits ahead, no changes touching .github/actions/interpolate-prompt/** — the bumped action's surface is unchanged.
3. Callsite compatibility — inspected dispatch-review.yaml at trigger-repo/.github/workflows/dispatch-review.yaml: it still passes exactly AUTOMATION_GITHUB_APP_ID + AUTOMATION_GITHUB_APP_PRIVATE_KEY as secrets and no with: overrides. No callsite change is required for any of the three bumps.

Notes (non-blocking)

• Because the agents bump rolls up ~19 release tags in one hop, most of the runtime behavior delta actually lives upstream — worth watching the next review-receiver run to confirm the receiver-side fixes land cleanly. Not a review blocker; automerge (10am–4pm ET) is appropriate.
• The # main trailing comment on every bumped line is preserved, keeping renovate's regex managers happy for the next bump.

Recommendation

APPROVE. Automerge enabled — no action needed beyond letting CI settle.

Follow-ups: none.

---

• Workflow run: https://github.com/nsheaps/.ai-agent-henry/actions/runs/32073773764
• Source repo diffs verified: nsheaps/github-actions@c1794f6...1e12939 · nsheaps/agents@9384e01...e430440 · nsheaps/ai-mktpl@329302c...8bcd014