build(deps): batch the open dependabot bumps

[sdh100shaun]

Batches the open dependabot bumps into one branch off main, so the seven
PRs below land as a single review with one lockfile resolution instead of
seven conflicting ones.

GitHub Actions

Action	From	To	Supersedes
actions/setup-node	4	7	#163
actions/upload-pages-artifact	3	5	#164
actions/upload-artifact	4	7	#165
peter-evans/create-pull-request	6	8	#166
actions/github-script	7	9	#167

Each of these is dependabot's own commit, cherry-picked unchanged with
authorship preserved.

npm

Package	From	To	Supersedes
astro	7.2.4	7.2.9	#168
fast-xml-parser	5.11.0	5.11.1	#170

astro resolves to 7.2.9 rather than the 7.2.8 #168 pinned — the ^7.2.8
range picked up a newer patch by the time the lockfile was regenerated.
package-lock.json was regenerated once from main, rather than merging
three separately-resolved lockfiles against each other.

Deliberately excluded

typescript 6 → 7 (#169, already closed). @astrojs/check@0.9.10
peer-requires typescript ^5.0.0 || ^6.0.0 and 0.9.10 is the latest
published version, so TS 7 fails npm ci and would break npm run check.

Scope

Workflows and manifests only — no source file is touched:

.github/workflows/ci.yml
.github/workflows/deploy.yml
.github/workflows/monitor.yml
.github/workflows/process-suggestion.yml
package.json
package-lock.json

Verification

npm ci and npm run build clean on the branch. Playwright was run against
both this branch and unmodified main and gives identical results, so
nothing here regresses the suite. CI runs the full suite on this PR.

Note for whoever merges second

This branch and #161 both touch ci.yml, deploy.yml and the manifests,
in different places. Whichever merges second will conflict only in
package-lock.json; resolve it with npm install rather than by hand.
#161 also adds CI jobs that pin actions/setup-node@v4, matching main's
convention today — after both land, those new jobs will want the same bump
to v7 that this PR makes everywhere else.

🤖 Generated with Claude Code

https://claude.ai/code/session_018P7xBafhEuazagBUqaRFo3

[Copilot]

Pull request overview

Batches multiple Dependabot updates into a single set of workflow and dependency bumps to reduce lockfile conflicts and keep CI/deploy tooling current for this Astro-based static site.

Changes:

• Bumped GitHub Actions used across CI/deploy/monitor/suggestion workflows (setup-node, upload-artifact, upload-pages-artifact, github-script, create-pull-request).
• Updated npm dependencies (astro, fast-xml-parser) and regenerated package-lock.json accordingly.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Updates runtime dependencies to newer patch versions.
package-lock.json	Regenerates lockfile to resolve updated dependency tree (Astro + transitive updates).
.github/workflows/ci.yml	Bumps setup-node and artifact upload actions used in CI jobs.
.github/workflows/deploy.yml	Bumps setup-node and Pages artifact upload action for deploy pipeline.
.github/workflows/monitor.yml	Bumps setup-node used by the live-site monitor job.
.github/workflows/process-suggestion.yml	Bumps github-script/setup-node/create-pull-request used by the suggestion automation workflow.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.