chore(ci): dependabot vale-action/setup-node bumps point at invalid refs (PRs #107, #108) #117

Problem

Two open dependabot PRs bump GitHub Actions to refs that don't resolve cleanly, and the underlying frontend-skills-qa.yml is itself broken (#113), so they can't go green:

PR #108 — errata-ai/vale-action d89dee9 → 85f9f7f (labeled v2.2.0)

• There is no v2.2.0 tag on the action repo; latest release is 2.1.2. The version comment is wrong.
• The current pin d89dee9 is the repo's v2 tag (note 'Add note about deps').
• The proposed SHA 85f9f7f lives on a reviewdog branch of vale-cli/vale-action (the repo moved from errata-ai → vale-cli).

PR #107 — actions/setup-node 4.4.0 → 6.4.0

• Blocked because frontend-skills-qa.yml has a startup failure (fix(ci): frontend-skills-qa.yml fails on every run (invalid hashFiles() in job-level if) #113); the bump can't be validated until that's fixed.

Recommendation

1. Land fix(ci): frontend-skills-qa.yml fails on every run (invalid hashFiles() in job-level if) #113 first (fix the workflow).
2. For vale: pin to a real released tag SHA (v2.1.2) or intentionally move to vale-cli/vale-action and fix the uses: org + version comment. Don't merge a bump whose comment claims a nonexistent v2.2.0.
3. Re-run chore(ci): Bump actions/setup-node from 4.4.0 to 6.4.0 #107 after fix(ci): frontend-skills-qa.yml fails on every run (invalid hashFiles() in job-level if) #113 merges; close/recreate if dependabot's comment is stale.

Acceptance

• No workflow references a nonexistent tag
• Version comments match the pinned SHA's actual tag