ci: bump the actions group across 1 directory with 4 updates

.github/workflows/aggregate.yml

@@ -90,7 +90,7 @@ jobs:
       # mint on a correctly-scoped door. The three write lanes do declare it.
       - name: Mint the catalog-aggregate token via the OIDC broker
         id: app-token
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@d126d721fa50275e12af0bdeaf1a2ff3016eedfd # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # broker-gh-token (prx-26bq), .github#109
         with:
           app: catalog-aggregate
           broker-url: ${{ vars.CF_BROKER_URL }}
@@ -141,7 +141,7 @@ jobs:
       # unchanged night proposes nothing instead of opening an empty PR.
       - name: Publish catalog.merged.json to a branch (signed)
         id: pub-catalog
-        uses: bounded-systems/.github/.github/actions/signed-commit@d126d721fa50275e12af0bdeaf1a2ff3016eedfd # signed-commit
+        uses: bounded-systems/.github/.github/actions/signed-commit@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # signed-commit
         with:
           path: catalog.merged.json
           branch: catalog/refresh-${{ github.run_id }}
@@ -154,7 +154,7 @@ jobs:
 
       - name: Publish grounding.merged.json to the same branch (signed)
         id: pub-grounding
-        uses: bounded-systems/.github/.github/actions/signed-commit@d126d721fa50275e12af0bdeaf1a2ff3016eedfd # signed-commit
+        uses: bounded-systems/.github/.github/actions/signed-commit@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # signed-commit
         with:
           path: grounding.merged.json
           branch: catalog/refresh-${{ github.run_id }}

.github/workflows/bootstrap.yml

@@ -85,7 +85,7 @@ jobs:
       # over-scoped preview.
       - name: Mint the catalog-bootstrap token via the OIDC broker
         id: app-token
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@d126d721fa50275e12af0bdeaf1a2ff3016eedfd # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # broker-gh-token (prx-26bq), .github#109
         with:
           app: catalog-bootstrap
           broker-url: ${{ vars.CF_BROKER_URL }}

.github/workflows/claim-sweep.yml

@@ -69,7 +69,7 @@ concurrency:
 jobs:
   sweep:
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@d126d721fa50275e12af0bdeaf1a2ff3016eedfd
+    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c
     permissions:
       contents: read
       issues: write

.github/workflows/enrich.yml

@@ -55,7 +55,7 @@ jobs:
       # refs/heads/main. Minted on the dry-run lane too — see bootstrap.yml.
       - name: Mint the catalog-enrich token via the OIDC broker
         id: app-token
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@d126d721fa50275e12af0bdeaf1a2ff3016eedfd # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # broker-gh-token (prx-26bq), .github#109
         with:
           app: catalog-enrich
           broker-url: ${{ vars.CF_BROKER_URL }}

.github/workflows/front-desk-add.yml

@@ -59,7 +59,7 @@ jobs:
         id: app-token
         if: ${{ vars.CF_BROKER_URL != '' }}
         continue-on-error: true
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@d126d721fa50275e12af0bdeaf1a2ff3016eedfd # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # broker-gh-token (prx-26bq), .github#109
         with:
           app: front-desk
           broker-url: ${{ vars.CF_BROKER_URL }}

.github/workflows/pr-claim.yml

@@ -81,4 +81,4 @@ jobs:
       issues: read
       pull-requests: read
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@bc4cb7dada47cc59eed416372a4851201bd6f503
+    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c

.github/workflows/seed.yml

@@ -51,7 +51,7 @@ jobs:
       # why a preview on the weaker token is the worse option.
       - name: Mint the catalog-seed token via the OIDC broker
         id: app-token
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@d126d721fa50275e12af0bdeaf1a2ff3016eedfd # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@1716efd3a3cc81ba97e0ff2be0f9a0a0ebd6574c # broker-gh-token (prx-26bq), .github#109
         with:
           app: catalog-seed
           broker-url: ${{ vars.CF_BROKER_URL }}