chore(deps): update nsheaps + squink github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
nsheaps/agents (changelog)	action	digest	9384e01 → e430440
nsheaps/github-actions (changelog)	action	digest	c1794f6 → 1e12939

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Preview Deployment

The app for this PR has been deployed:

Open Preview

Use this to verify the app works correctly.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

Dismissed: new commits since last approval require re-review.

[henry-nsheaps]

✅ Approve — routine Renovate SHA bump, consumed contracts byte-identical

• ✅ 4 @sha pins updated across 3 workflow files; no logic/YAML structure changes
• ✅ nsheaps/github-actions c1794f6...1e12939 = 1 commit touching only sync-plugin-specs.yaml; the 3 consumed actions (checkout-as-app, apply-repo-settings, github-app-auth) are untouched
• ✅ nsheaps/agents bcfea14...e430440 = 3 commits (2 template scaffolding + 1 release); consumed reusable review-dispatch.yaml blob SHA is byte-identical (d4144c19...) at both refs
• ✅ Full 40-char SHA pins + # main provenance comment retained on all refs — consistent with repo convention

Click to expand for full details

What changed

File	Ref	Old → New
.github/workflows/apply-repo-settings.yaml	nsheaps/github-actions/.github/actions/checkout-as-app	c1794f6 → 1e12939
.github/workflows/apply-repo-settings.yaml	nsheaps/github-actions/.github/actions/apply-repo-settings	c1794f6 → 1e12939
.github/workflows/dispatch-review.yaml	nsheaps/agents/.github/workflows/review-dispatch.yaml	9384e01 → e430440
.github/workflows/pr-status-dispatch.yaml	nsheaps/github-actions/.github/actions/github-app-auth	c1794f6 → 1e12939

Upstream delta analysis

nsheaps/github-actions c1794f6...1e12939 — 1 commit (#120), 1 file (.github/workflows/sync-plugin-specs.yaml, 12-line delta). None of the three actions consumed by this repo (checkout-as-app, apply-repo-settings, github-app-auth) is in the changed file set. Effectively a no-op for this repo's runtime behavior. ✅

nsheaps/agents bcfea14...e430440 — 3 commits from automation-nsheaps[bot]: [sync] Create .github/CODEOWNERS (b7450dc), [sync] Create .github/pull_request_template.md (1d5decf), and chore: release v0.3.135 [skip ci] (e430440, updates CHANGELOG.md only). All three files are internal to the nsheaps/agents repo — none of them affect the reusable workflow this repo consumes. Verified via gh api /repos/nsheaps/agents/contents/.github/workflows/review-dispatch.yaml: blob SHA is identical (d4144c192c9f05aa5446d08d750a83ce6c710404) at both refs. Workflow interface (workflow_call.inputs + secrets + permissions) is unchanged by construction. ✅

Full cumulative delta from base (9384e01...e430440): ~54 commits, v0.3.116 → v0.3.135, receiver-side changes previously analyzed and self-verifying (this very review run exercises the newer receiver code path).

Review dimensions

• 🔒 Security: ✅ Full 40-char SHA pins on all uses: refs with # main provenance comment. No shift to floating refs or version tags. Consistent with repo convention.
• 🐛 Correctness: ✅ All four @sha values match the Renovate table. No YAML structure or with:/secrets: block changes. dispatch-review.yaml's conditional gate, permissions block, and secret passthrough all preserved verbatim.
• 🏗️ Maintainability: ✅ Same SHA applied consistently to every nsheaps/github-actions ref in the same PR — no partial bump that could leave two actions on different upstream versions.
• 📝 PR description accuracy: ✅ Renovate-generated table matches the diff. Two entries (nsheaps/agents, nsheaps/github-actions), digest updates only.
• 🧪 Testing: Preview deploy already ran and posted its URL. The review workflow itself is the practical smoke test for the agents bump — if the receiver contract had broken, this comment wouldn't exist.

Note on prior reviews

Three earlier approvals (at commits 23172f2, e9bc32b, fc0659f) were auto-dismissed as Renovate advanced the nsheaps/agents ref through 4dc6f60 → a3702c0 → bcfea14 → current e430440. Each intermediate advance added only automation [sync]/release commits with no change to the consumed review-dispatch.yaml blob. Approval carries over. Prior reviews have been minimized as outdated.

Follow-ups:

None.

---

_{🤖 Automated review · verdict derived from diff scope (4 SHA bumps, zero logic changes), verified upstream file-list deltas, and byte-identical review-dispatch.yaml blob SHA at old vs new refs}

References:

• Workflow run
• nsheaps/github-actions compare c1794f6...1e12939
• nsheaps/agents compare 9384e01...e430440