chore(canon): update first-party canon

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
monumental-archive/.github		minor	v1.59.0 → v1.61.1
monumental-archive/.github	action	minor	v1.59.0 → v1.61.1
monumental-archive/.github	workflow	minor	v1.59.0 → v1.61.1
monumental-archive/signer (changelog)	workflow	digest	13e7af0 → 8018458

---

Release Notes

monumental-archive/.github (monumental-archive/.github)

v1.61.1

Compare Source

Fixed

• let fix:rust write the tree it formatted (#​892) (#​906)
• lock file maintenance (#​909)
• name the org in every registry curl (#​907) (#​910)
• let derive-badges say what it found (#​905) (#​913)
• let citation.sh say which field is missing (#​911) (#​915)
• say why npm could not use trusted publishing (#​907) (#​914)

v1.61.0

Compare Source

Added

• add the wasm-pack arch correction and audit (#​811) (#​870)
• record and guard the org-wide grant model (#​751) (#​853)
• run the scaffold as a repository in the gate (#​777) (#​877)
• report classic branch protection as drift (#​761) (#​874)
• select the delivered aqua registry (#​811) (#​882)
• stage the committed arch correction (#​854) (#​885)
• correct the committed architecture (#​854) (#​898)
• refuse a [workspace.package] key nobody inherits (#​863) (#​890)
• report a repo's own rulesets as drift (#​876) (#​897)
• move to stele v0.20.0 and jsonx epoch 7 (#​901)
• compile the declared MSRV at its pinned rustc (#​820) (#​865)
• compile the pgrx crate the gate never saw (#​813) (#​900)

Fixed

• guard canon-only legs on identity, red on inputs (#​738) (#​855)
• scrub git's environment from the pgrx harness (#​857) (#​869)
• read installability from the release path's record (#​871)
• let the canon track its own delivered rust configs (#​856)
• guard canon-only lints on identity and file shape (#​858) (#​879)
• resolve a repo's own top-level message fields (#​725) (#​873)
• catch a gate measuring another belt (#​867) (#​878)
• declare the contents grant the tag job spends (#​883)
• update monumental-archive/signer to 32fa844 (#​888)
• refuse a nested mise run inside a task body (#​764) (#​866)
• resume from HEAD's tag, not from the plan's (#​864) (#​889)
• key the evidence by the digests consumers pull (#​887)
• name the endpoint and grant on a failed read (#​862) (#​895)
• guard every fixer on what it rewrites (#​860) (#​893)
• hold the squash body to the commit canon (#​880) (#​886)
• map each ts extension to the js one tsc resolves (#​868) (#​894)
• lock file maintenance (#​902)
• relock five tools onto their musl assets (#​899) (#​903)

Testing

• table-test the release scripts' decisions (#​772) (#​881)

v1.60.0

Compare Source

Added

• split the crate-built image into its own evidence class (#​844)
• require a root changelog in versioned repos (#​742) (#​847)
• emit the rust-crate plan and lint the join (#​833) (#​861)

Fixed

• update first-party canon (#​835)
• update postgres to 06cad38 (#​837)
• update postgres to e384114 (#​838)
• update postgres to 5f72c7b (#​839)
• update postgres to e17e860 (#​840)
• update postgres to 2fdfb9b (#​841)
• update aqua:taiki-e/cargo-llvm-cov to 0.9.0 (#​842)
• draw the org-wide walks from AUDIT_TOKEN (#​749) (#​845)
• count the clippy exclusions the run applied (#​846)
• refuse a PR title ending in its own reference (#​800) (#​848)
• drop the GITHUB_TOKEN no release step reads (#​741) (#​849)
• catch the setup-* family's silent cache (#​732) (#​851)
• read every matcher a packageRule carries (#​724) (#​852)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.