chore(deps): update nsheaps + squink github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
nsheaps/agents (changelog)	action	digest	c11e86f → 51887d0
nsheaps/ai-mktpl (changelog)	action	digest	8bcd014 → 1f8fadf

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Plugin Version Preview

Preview only — plugin versions and marketplace.json are bumped automatically on merge to main, not in this PR. Manual bumps to higher versions are preserved. See the file annotations for the pending change on each plugin.json.

Plugin	Base	Current	Action
review-utils	0.2.7	0.2.8	Auto-bumped

[henry-nsheaps]

✅ Approved — routine Renovate digest bump, verified safe

• ✅ Both target SHAs verified against upstream main HEAD
• ✅ interpolate-prompt action source is unchanged across the ai-mktpl delta
• ✅ # main comments remain accurate; digest-pinning convention preserved
• ✅ No inline findings; scope is +2/-2 across 2 workflow files

Click to expand for full details

What changed

Two uses: digest pins bumped by Renovate:

File	Reference	Old → New
.github/workflows/dispatch-review.yaml	nsheaps/agents/.github/workflows/review-dispatch.yaml	c11e86f → 51887d0
plugins/claude-code/review-utils/actions/run-agent/action.yaml	nsheaps/ai-mktpl/.github/actions/interpolate-prompt	8bcd014 → 1f8fadf

Verification

Target SHAs exist and match main HEAD

• nsheaps/agents@51887d0 — chore: release v0.3.137 [skip ci] (2026-08-19) — currently main HEAD.
• nsheaps/ai-mktpl@1f8fadf — chore: \mise run lint`(2026-08-24) — currentlymain` HEAD.

Delta review

• nsheaps/agents c11e86f..51887d0: 2 commits, both benign — one workflow sync ([sync] Update .github/workflows/dispatch-review.yaml) and the release commit. This is the self-reference the surrounding comment (review-dispatch.yaml L62–65) intentionally floats at main; bumping in lock-step with the release is the documented expectation.
• nsheaps/ai-mktpl 8bcd014..1f8fadf: 12 commits changing .github/workflows/*, .github/settings.yml, mise.toml, .claude/rules/*, docs/research/*, and an eslint dep bump. None of the 12 commits touch .github/actions/interpolate-prompt/ — the consumed action code is functionally identical. This is a pure metadata bump.

Code quality / conventions

• Comment pinning strategy (# main) still holds.
• Full 40-char SHA pins preserved on both uses: lines (immutable reference; withstands force-push).
• No changes outside the two uses: lines; no incidental drift.

Security

• Both SHAs resolve inside the trusted nsheaps/* org.
• Immutable-SHA pinning is the recommended posture per GitHub's supply-chain guidance; this PR maintains it.
• No secret / permissions surface changed.

Simplicity & maintainability

• +2/-2, single-purpose, Renovate-owned. Recreates on close per the PR body.

Follow-ups: None.

---

References

• Workflow run: https://github.com/nsheaps/.ai-agent-henry/actions/runs/32703965963
• GitHub Actions supply-chain hardening: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
• Renovate pinDigests: https://docs.renovatebot.com/configuration-options/#pindigests