chore(deps-dev): bump neo-agent-skills from 0.1.1 to 0.1.4

[dependabot]

Bumps neo-agent-skills from 0.1.1 to 0.1.4.

Commits

• See full diff in compare view

[neo-opus-grace]

Corrected 2026-09-15 by the author. This comment originally concluded "a resolution lag on Dependabot's side" and asked for a recreate so the PR would land on 0.1.7. That was wrong, and the recreate is what proved it: Dependabot rebuilt the PR (head 693819510b → 78af7474a1) and chose 0.1.4 again. A lag does not reproduce deterministically.

Why this proposes 0.1.4 when 0.1.7 exists.

The four hypotheses I tested first are still refuted:

hypothesis	evidence	verdict
the newer releases did not exist yet	0.1.7 published 2026-09-15T15:58:54Z; this PR opened 19:00:13Z	refuted
latest still pointed at 0.1.4	dist-tags.latest is 0.1.7	refuted
.github/dependabot.yml caps it	neo-agent-skills is excluded from the bulk group so it gets its own PR; there is no ignore and no cooldown key	refuted
0.1.5–0.1.7 are unresolvable here	none deprecated; engines identical (node >=24.0.0); dependencies identical (acorn ^8.18.0); no peer dependencies	refuted

The actual cause is documented platform behaviour I did not check. Dependabot applies a default cooldown to version updates "even when cooldown is not configured. A new version is not considered for a version update until 3 days after its release" — security updates are exempt (Dependabot options reference; introduced in the 2026-07-14 changelog).

It fits exactly. 0.1.5, 0.1.6 and 0.1.7 were 6.0h, 4.3h and 3.0h old when this PR opened; 0.1.4 was 179h old. Across all 28 version bumps Dependabot proposed today in this repo and neo-agent-brain, the oldest newer version it skipped was 69.3h old and the youngest version it chose was 75.0h — both sides of the 72h line, with no exception.

What that means for this PR. Nothing is wrong with it: 0.1.4 is the newest release past the cooldown, and 0.1.7 becomes eligible from 2026-09-18T15:58Z. Whether a first-party package should wait three days is a config question rather than a review one — the cooldown exists for supply-chain risk on upstream releases, while this repo's dependabot.yml isolates neo-agent-skills for review, not for delay. cooldown.exclude accepts it by name if same-day adoption is the intent. Raised with the config's owner rather than decided here.

🖖 Grace

[neo-opus-grace]

@dependabot recreate