Add bin/bump-deps: one command to see and bump every pinned dependency

[jfmercer]

Addresses topic #4 from yesterday's backlog. Pins were spread across four files with no shared mechanism, and Dependabot reads none of them — so drift was invisible until someone went looking.

The design point

A pin is not always a version. There are four classes here, and a tool that treated them uniformly would be actively harmful — auto-updating a GPG key fingerprint would defeat the entire reason it's pinned.

Class	Where	What bumping means
VERSION	install.sh, ci.yaml, linux installs	Latest stable release. Automatic.
EXTERNAL	14 × .chezmoiexternal.yaml	Move to master HEAD, recompute sha256. Confirmed per entry with a compare URL, because it pulls upstream code nobody has read into every interactive shell and tmux session.
CONTENT	RUSTUP_INIT_SHA256	A hash over an unversioned URL. No version to compare — a change means upstream rewrote the installer. Reported; requires --accept.
ANCHOR	EZA_KEY_FPR	A GPG public-key fingerprint. Never rewritten. A mismatch is key rotation or an attack; prints a security notice pointing at upstream's own announcement.

Two things that look like pins but aren't, and are left alone: .chezmoiversion is a floor, not a pin; Homebrew and apt packages are deliberately rolling.

Cross-file invariants

Nothing previously checked these:

1. .chezmoiversion ≤ install.sh's CHEZMOI_VERSION. The floor is the minimum chezmoi permitted to read this source. If it outruns the version the bootstrap installs, a fresh machine installs chezmoi and is then refused by it — silent bootstrap breakage. Verified by simulating a 2.99.0 floor.
2. No external may track a moving ref (master/HEAD).
3. Actions pinned to an exact release, not a floating major tag.

Invariant 3 found a real one: gitleaks-action was pinned to v3, a tag upstream moves. Now v3.0.0.

Interface

bump-deps              # status table: class, current, latest
bump-deps --check      # terse; exit 1 if action needed (CI mode)
bump-deps --apply      # bump versions; confirm each external
bump-deps --self-test  # prove the in-place editing is surgical

After --apply it runs chezmoi apply --dry-run --refresh-externals and re-checks, so a bad checksum fails immediately rather than at your next real apply.

Implementation choices

Python, stdlib only — no pip, no venv, no requirements.txt. A dependency tool that needs dependencies is its own bootstrap problem. gh supplies the API (already in both package lists, authenticated on CI). It runs by hand, so interpreter startup is irrelevant — unlike the bin/ shell scripts on the PATH hot path.

No YAML library, deliberately. 36 of .chezmoiexternal.yaml's 136 lines are comments explaining why each thing is pinned. yaml.safe_load/dump would erase every one. Edits are line-oriented so the file stays byte-stable apart from the values being changed.

Verification

Everything below was executed, not reasoned about:

• --self-test rewrites each pin to a sentinel and asserts only the captured value changed — no surrounding syntax, no line-count change — then restores every file. It's wired into CI so that guarantee is enforced rather than assumed. Confirms actions/checkout correctly edits all 4 occurrences and the externals edit preserves comments.
• Both alarm paths driven with fabricated failures: a rotated EZA_KEY_FPR produces the security notice, exits non-zero, and is not rewritten even under --apply ("nothing to do"). A changed RUSTUP_INIT_SHA256 is reported and left alone until --accept rustup.
• Both invariants driven with fabricated violations (a 2.99.0 floor; an external reverted to master.tar.gz).
• Detects and classifies all 21 pins correctly; --check exits 0 with everything current.
• shellcheck correctly skips the Python file (shebang selection), which is exactly why the py_compile step was added — otherwise it'd be unchecked.
• Self-test leaves the tree clean, so it won't trip the apply job's no-drift gate.

Scheduled check

.github/workflows/deps.yaml — weekly cron plus workflow_dispatch. Runs --check, keeps one tracking issue in sync (updates rather than reopening), closes it when everything is current, and titles CONTENT/ANCHOR changes as security signals rather than routine updates. It never commits.

The cron is the one thing I can't verify here; it needs a real scheduled run or a manual workflow_dispatch. Worth triggering once by hand after merge.

Also in this PR

The two housekeeping changes that were sitting uncommitted: your .chezmoiversion bump to 2.71.1, and the CLAUDE.md note that the GitLab SSH block was retired.