Weekly dependency-bump loop. Scan for updates, test compatibility against the suite, open one PR per safe bump. Highest accept-rate, lowest risk — the harden-first loop. Trigger weekly or on a dependency-advisory webhook.
