upgrade-dependencies-pr

SUSPICIOUS: core dependency-upgrade and GitHub actions are coherent and mostly use official tooling, but the skill’s scheduled-failure path executes an external, non-included Ops Triage producer backed by a separate .env, creating a trust gap and outbound reporting path beyond ordinary dependency maintenance. Not confirmed malicious, but the unverifiable external executable path makes the skill higher risk than a typical workflow guide.