fix(ci): fix invalid YAML syntax in weekly-update workflow

The inline multi-line PR body string caused YAML parsing failures because
`### Commits` was interpreted as a YAML mapping key. Moved to a heredoc.

Also fixed: removed persist-credentials: false from apply-updates job
(was blocking git push), corrected inputs.dry-run to use
github.event.inputs context, and added set -o pipefail so claude
failures are properly captured through the tee pipe.

Author: jdalton

.github/workflows/weekly-update.yml

@@ -27,7 +27,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Node.js
@@ -57,7 +56,7 @@ jobs:
   apply-updates:
     name: Apply updates with Claude Code
     needs: check-updates
-    if: needs.check-updates.outputs.has-updates == 'true' && inputs.dry-run != true
+    if: needs.check-updates.outputs.has-updates == 'true' && github.event.inputs.dry-run != 'true'
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -67,7 +66,6 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
@@ -101,18 +99,17 @@ jobs:
           CI: 'true'
           GITHUB_ACTIONS: 'true'
         run: |
+          set -o pipefail
           if [ -z "$ANTHROPIC_API_KEY" ]; then
             echo "⚠️  ANTHROPIC_API_KEY not set - skipping automated update"
             echo "success=false" >> $GITHUB_OUTPUT
             exit 0
           fi
 
-          claude --print --dangerously-skip-permissions \
+          if claude --print --dangerously-skip-permissions \
             --model sonnet \
             "/updating - Run the updating skill to update all dependencies. Create atomic commits for each update. You are running in CI mode - skip builds and tests. Do not push or create a PR." \
-            2>&1 | tee claude-output.log
-
-          if [ $? -eq 0 ]; then
+            2>&1 | tee claude-output.log; then
             echo "success=true" >> $GITHUB_OUTPUT
           else
             echo "success=false" >> $GITHUB_OUTPUT
@@ -142,26 +139,33 @@ jobs:
           COMMITS=$(git log --oneline origin/main..HEAD)
           COMMIT_COUNT=$(git rev-list --count origin/main..HEAD)
 
-          gh pr create \
-            --title "chore(deps): weekly dependency update ($(date +%Y-%m-%d))" \
-            --body "## Weekly Dependency Update
+          BODY=$(cat <<EOF
+          ## Weekly Dependency Update
+
+          Automated weekly update of npm packages.
 
-Automated weekly update of npm packages.
+          ### Commits (${COMMIT_COUNT})
 
-### Commits (${COMMIT_COUNT})
+          <details>
+          <summary>View commit history</summary>
 
-<details>
-<summary>View commit history</summary>
+          \`\`\`
+          ${COMMITS}
+          \`\`\`
 
-\`\`\`
-${COMMITS}
-\`\`\`
+          </details>
 
-</details>
+          ---
 
----
+          <sub>Generated by [weekly-update.yml](.github/workflows/weekly-update.yml)</sub>
+          EOF
+          )
+          # Strip leading whitespace from heredoc lines
+          BODY=$(echo "$BODY" | sed 's/^          //')
 
-<sub>Generated by [weekly-update.yml](.github/workflows/weekly-update.yml)</sub>" \
+          gh pr create \
+            --title "chore(deps): weekly dependency update ($(date +%Y-%m-%d))" \
+            --body "$BODY" \
             --draft \
             --head "$BRANCH_NAME" \
             --base main