diff --git a/.claude/pr-reviews/nsheaps/github-actions/1/1771874092/documentation/REPORT.md b/.claude/pr-reviews/nsheaps/github-actions/1/1771874092/documentation/REPORT.md
index 47964ad..65c5390 100644
--- a/.claude/pr-reviews/nsheaps/github-actions/1/1771874092/documentation/REPORT.md
+++ b/.claude/pr-reviews/nsheaps/github-actions/1/1771874092/documentation/REPORT.md
@@ -100,15 +100,15 @@ This PR delivers strong, well-structured documentation that significantly exceed
 
 ### Summary of Deductions
 
-| Category                           | Deduction | Reason                                                                |
+| Category | Deduction | Reason |
 | ---------------------------------- | --------- | --------------------------------------------------------------------- | --- | -------------------------------- |
-| Missing troubleshooting/error docs | -5        | No guidance on common failure modes                                   |
-| Missing prerequisites              | -2        | No runner/dependency requirements noted                               |
-| Incomplete edge-case docs          | -4        | maxdepth 2 limit, root-path sync naming, never-deletes implications   |
-| env-vars behavior mismatch         | -2        | README implies compose-level injection, script does GITHUB_ENV export |
-| auth-type values underdocumented   | -2        | No explanation of what each auth type requires                        |
-| Missing function docstrings        | -2        | `discover_compose_files` and `export_env_vars` lack docstrings        |
-| Minor inline comment gaps          | -1        | `                                                                     |     | true`on curl,`sort -z` rationale |
+| Missing troubleshooting/error docs | -5 | No guidance on common failure modes |
+| Missing prerequisites | -2 | No runner/dependency requirements noted |
+| Incomplete edge-case docs | -4 | maxdepth 2 limit, root-path sync naming, never-deletes implications |
+| env-vars behavior mismatch | -2 | README implies compose-level injection, script does GITHUB_ENV export |
+| auth-type values underdocumented | -2 | No explanation of what each auth type requires |
+| Missing function docstrings | -2 | `discover_compose_files` and `export_env_vars` lack docstrings |
+| Minor inline comment gaps | -1 | `                                                                     |     | true`on curl,`sort -z` rationale |
 
 ## References
 
diff --git a/.github/actions/checkout-as-app/action.yml b/.github/actions/checkout-as-app/action.yml
index dcd77de..317cdd4 100644
--- a/.github/actions/checkout-as-app/action.yml
+++ b/.github/actions/checkout-as-app/action.yml
@@ -143,7 +143,7 @@ runs:
     # ── Step 2: Checkout with app token baked into the remote URL ──
     - name: Checkout repository as GitHub App
       id: checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       with:
         token: ${{ steps.auth.outputs.token }}
         repository: ${{ inputs.repository }}
diff --git a/.github/actions/github-app-auth/action.yml b/.github/actions/github-app-auth/action.yml
index eba0889..1bd9f58 100644
--- a/.github/actions/github-app-auth/action.yml
+++ b/.github/actions/github-app-auth/action.yml
@@ -94,7 +94,7 @@ runs:
 
     - name: Configure repo checkout token
       if: inputs.skip-checkout != 'true'
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       with:
         token: ${{ steps.app-token.outputs.token }}
         clean: false
diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 4d6e6fd..04058a7 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -22,7 +22,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -88,7 +88,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/pages.yaml b/.github/workflows/pages.yaml
index 59feb1d..e718757 100644
--- a/.github/workflows/pages.yaml
+++ b/.github/workflows/pages.yaml
@@ -33,7 +33,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Configure Pages
         uses: actions/configure-pages@v5
diff --git a/.github/workflows/sync-main-to-edge.yaml b/.github/workflows/sync-main-to-edge.yaml
index c4a6e96..bf4d77d 100644
--- a/.github/workflows/sync-main-to-edge.yaml
+++ b/.github/workflows/sync-main-to-edge.yaml
@@ -43,7 +43,7 @@ jobs:
       has_targets: ${{ steps.plan.outputs.has_targets }}
     steps:
       - name: Checkout caller repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           persist-credentials: false
 
@@ -122,7 +122,7 @@ jobs:
 
       - name: Checkout target branch
         if: steps.check.outputs.exists == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ matrix.target }}
           persist-credentials: false
diff --git a/.github/workflows/sync-plugin-specs.yaml b/.github/workflows/sync-plugin-specs.yaml
index 539b892..328d332 100644
--- a/.github/workflows/sync-plugin-specs.yaml
+++ b/.github/workflows/sync-plugin-specs.yaml
@@ -34,7 +34,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/LICENSE.md b/LICENSE.md
index e70157b..c3fc5da 100644
--- a/LICENSE.md
+++ b/LICENSE.md
@@ -11,7 +11,7 @@ Copyright (c) 2026 Nathan Heaps. All rights reserved.
 >   (https://polyformproject.org/licenses/internal-use/1.0.0), which is
 >   purpose-built for "use the software for internal business operations, do
 >   not distribute it." The one substantive adaptation is that PolyForm grants
->   rights to *"you and your company"* (whoever accepts the license), whereas
+>   rights to _"you and your company"_ (whoever accepts the license), whereas
 >   this license grants them to a **single, specifically named licensee**
 >   (Oura, defined below). That is a real difference: the licensor here is not
 >   a generic member of the licensee's organization, so the "permitted
diff --git a/pages/index.html b/pages/index.html
index 820fe74..caec1b6 100644
--- a/pages/index.html
+++ b/pages/index.html
@@ -319,8 +319,7 @@ <h2>Detailed setup walkthrough</h2>
       </p>
       <pre>
 cp pages/index.html docs/index.html
-# Settings → Pages → Source: GitHub Actions (or branch /docs)</pre
-      >
+# Settings → Pages → Source: GitHub Actions (or branch /docs)</pre>
       <p>
         Then use <code>https://&lt;your-org&gt;.github.io/&lt;repo&gt;/</code> as the redirect. Any
         other HTTPS static host (Vercel, Netlify, etc.) works equally well.