chore(deps): update nsheaps + squink github actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
nsheaps/agents (changelog)	workflow	digest	57debfc → 2c8990f
nsheaps/ai-mktpl (changelog)	action	digest	05b6f52 → f03178c

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "after 10am and before 4pm every weekday"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Plugin Version Preview

Preview only — plugin versions and marketplace.json are bumped automatically on merge to main, not in this PR. Manual bumps to higher versions are preserved. See the file annotations for the pending change on each plugin.json.

Plugin	Base	Current	Action
review-utils	0.2.10	0.2.11	Auto-bumped

Dismissed: new commits since last approval require re-review.

[henry-nsheaps]

✅ Approved — Renovate SHA bumps, contracts preserved

Two full-SHA pin bumps for internal nsheaps/* workflow/action references. Both target files are byte-identical at the old and new SHAs, so this is a pure lockstep pin update with no behavior change.

Changes

File	Ref	Old → New
.github/workflows/dispatch-review.yaml (line 68)	nsheaps/agents/.github/workflows/review-dispatch.yaml	57debfc → 2c8990f
plugins/claude-code/review-utils/actions/run-agent/action.yaml (line 228)	nsheaps/ai-mktpl/.github/actions/interpolate-prompt	05b6f52 → f03178c

Verification

Check	Result
New agents SHA 2c8990f resolves	✅ chore: release v0.3.155 (2026-09-28, automation-nsheaps[bot])
New ai-mktpl SHA f03178c resolves	✅ chore: mise run lint (2026-09-28, automation-nsheaps[bot])
Called review-dispatch.yaml byte-identical across bump	✅ blob d4144c19… at both refs (28 commits between, none touch this file)
Called interpolate-prompt/action.yml byte-identical across bump	✅ blob 015abb45… at both refs (3 commits between, none touch this file)
Caller with: / secrets: blocks unchanged	✅ Diff is pin-only on both files; inputs/secrets contracts untouched
Full-SHA pinning (not mutable tag)	✅ Both entries are 40-char SHAs with # main comment
Trusted source repos	✅ Both nsheaps/* — already used elsewhere in this template

Commits between the two agents SHAs (context only)

Files changed (57debfc…2c8990f, 28 commits):

• .claude-plugin/marketplace.json (+1/-1)
• .github/workflows/dispatch-review.yaml (+1/-1) — self-referential template file; not the reusable workflow this PR pins
• CHANGELOG.md (+74)
• mise.toml (+4/-4)
• plugins/claude-code/review-utils/.claude-plugin/plugin.json (+1/-1)
• plugins/claude-code/review-utils/actions/run-agent/action.yaml (+1/-1)

The reusable workflow being pinned (review-dispatch.yaml) is absent from this list — confirming zero behavior change for callers.

Commits between the two ai-mktpl SHAs (context only)

3 commits (05b6f52…f03178c):

• 0da5d531 — [org-settings] update .github/settings.yml
• cef1e461 — [sync] Update .github/workflows/pr-status-dispatch.yaml
• f03178c9 — chore: mise run lint

None touch .github/actions/interpolate-prompt/action.yml (blob confirmed identical).

Assessment

• Correctness: ✅ Both SHAs resolve; both called artifacts byte-identical
• Security: ✅ Full-SHA pins on trusted internal repos; no mutable refs
• Simplicity: ✅ 2-line diff, matches the documented lockstep-with-plugin-version-bump protocol (see dispatch-review.yaml:62-67 comment)
• Follow-ups: none

Safe to automerge per this PR's Renovate config.