build(deps): apply available Dependabot updates with 1ES checks

[pelikhan]

Summary

Apply the Dependabot updates that can currently be installed through the Microsoft 1ES feeds without introducing versions the feeds cannot resolve. This covers 6 of the 13 open proposals; the remaining 7 are intentionally deferred.

Dependency	Update
astral-sh/setup-uv	10.2.0 -> 10.3.0, with verified commit pin
@github/copilot-sdk	1.0.16 -> 1.0.22
@types/node	26.6.3 -> 26.6.5
prettier	3.9.9 -> 3.9.10
github.com/cli/go-gh/v2	2.16.1 -> 2.16.2
soupsieve	2.10 -> 3.0.3

Regenerate the npm lockfile and Go checksums, retain portable npmjs lockfile URLs, and preserve hash-verified Python installs. Document Python 3.11.5+ for the updated soupsieve wheel.

Deferred updates

The requested versions were unavailable from the configured 1ES feeds:

• vitest and @vitest/ui 5.0.5 (build(deps-dev): bump vitest from 5.0.3 to 5.0.5 in /actions/setup/js #70494, build(deps-dev): bump @vitest/ui from 5.0.3 to 5.0.5 in /actions/setup/js #70496).
• @astrojs/markdown-remark 7.3.3, astro 7.4.0, @playwright/test 1.64.1, and starlight-changelogs 0.7.1 (build(deps): bump @astrojs/markdown-remark from 7.3.2 to 7.3.3 in /docs #70495, build(deps): bump astro from 7.3.8 to 7.4.0 in /docs #70492, build(deps-dev): bump @playwright/test from 1.64.0 to 1.64.1 in /docs #70493, build(deps): bump starlight-changelogs from 0.7.0 to 0.7.1 in /docs #70489).
• geo-optimizer-skill 4.19.3 (build(deps): bump geo-optimizer-skill from 4.18.3 to 4.19.4 in /.github/workflows #70485).

These manifests remain unchanged rather than leaving dependency resolution broken.

Validation

Passed:

• make agent-report-progress, including impacted tests and workflow lockfile drift checks.
• make agent-report-progress-no-test after the final lockfile/checksum adjustments.
• make build and go mod verify.
• npm ci for actions/setup/js through the public 1ES npm feed, using --replace-registry-host=npmjs.
• npm run typecheck, npm run schema:session:check, and the session-focused Vitest selection: 335 tests passed against the exact locked SDK version.
• Hash-required downloads of the complete geo-optimizer requirements for Linux x86_64 / Python 3.11.5 through the configured Microsoft Python feed.

Full cross-platform 1ES availability is not confirmed. make check-npm-1es failed during the SDK 1.0.22 darwin-x64 tarball download with an Azure blob EIDLETIMEOUT; a subsequent changed-package check also encountered ENOTFOUND. Successful metadata resolution and local installation do not establish availability of every platform tarball.

[github-actions]

🧠 Matt Pocock Skills Reviewer is reviewing this pull request using Matt Pocock's engineering skills...

[github-actions]

🔬 Test Quality Sentinel is analyzing test quality on this pull request...

[github-actions]

🔍 Design Decision Gate 🏗️ is checking for design decision records on this pull request...

[github-actions]

🔎 PR Code Quality Reviewer is reviewing code quality for this pull request...

[Copilot]

🔵 Needs a closer look

Cross-platform SDK tarball availability through 1ES remains unverified after reported download failures.

1 open issue

• Harness SDK version pin mismatches dependency lockfile · New

1 file not reviewed

• actions/setup/js/package-lock.json: Generated file

What changed in this PR

Applies six dependency updates to gh-aw’s setup and workflow tooling, deferring seven proposals unavailable through 1ES.

Changes:

• Update selected npm, Go and Python dependencies and the setup-uv action pin.
• Refresh integrity data and document the Python minimum version.

File	Description
go.sum	Refresh go-gh checksums.
go.mod	Upgrade go-gh to 2.16.2.
actions/​setup/​js/​package.json	Update SDK, Node types and Prettier.
actions/​setup/​js/​package-lock.json	Lock updated npm versions and integrity hashes.
.github/​workflows/​requirements-geo-optimizer.txt	Upgrade soupsieve hashes and document Python minimum.
.github/​workflows/​copilot-setup-steps.yml	Pin setup-uv 10.3.0 to its commit.

_{Review effort: Max}