fix(workflow): address Cursor Bugbot findings on upgrade-deps PR

- Guarantee a trailing newline on commit-message.txt and pr-body.md
  before piping them through the heredoc into `$GITHUB_OUTPUT`. If
  Claude overwrites either file without a final `\n`, `cat` leaves the
  last line adjacent to the closing delimiter and GitHub Actions never
  terminates the multi-line value — producing a garbled body/commit.
- Fail fast in `updatePnpmWorkspace` when a version regex no longer
  matches the YAML. Previously we silently recorded `(unset) -> new`
  even though `.replace` was a no-op, which would ship a misleading
  dependency table. A stale pattern now surfaces as an explicit error
  so the script can be updated.

Author: fengmk2

.github/scripts/upgrade-deps.mjs

@@ -134,6 +134,12 @@ async function updatePnpmWorkspace(versions) {
 
   for (const { name, pattern, replacement, newVersion } of entries) {
     const oldVersion = content.match(pattern)?.[1];
+    if (!oldVersion) {
+      throw new Error(
+        `Failed to match ${name} in pnpm-workspace.yaml — the pattern ${pattern} is stale, ` +
+          `please update it in .github/scripts/upgrade-deps.mjs`,
+      );
+    }
     content = content.replace(pattern, replacement);
     recordChange(name, oldVersion, newVersion);
   }

.github/workflows/upgrade-deps.yml

@@ -228,6 +228,17 @@ jobs:
           COMMIT_FILE="${UPGRADE_DEPS_META_DIR}/commit-message.txt"
           BODY_FILE="${UPGRADE_DEPS_META_DIR}/pr-body.md"
 
+          # GitHub Actions heredoc outputs require the terminator on its own line,
+          # so guarantee a trailing newline regardless of what the generator wrote.
+          ensure_trailing_newline() {
+            local f="$1"
+            if [ -s "$f" ] && [ -n "$(tail -c1 "$f")" ]; then
+              printf '\n' >> "$f"
+            fi
+          }
+          ensure_trailing_newline "${COMMIT_FILE}"
+          ensure_trailing_newline "${BODY_FILE}"
+
           echo '--- commit-message.txt ---'
           cat "${COMMIT_FILE}"
           echo '--- pr-body.md ---'