[dependabot:release-train-updater] Bump astro and `@astrojs/markdown-remark` patch versions (blocked: create_pull_request 3rd failure)

## Dependency Release Train — prepared fix could not be submitted as a PR (systemic `create_pull_request` bug)

### What changed (prepared, not yet a PR)
- Package/ecosystem: npm (root workspace, `githubnext/gh-aw-cao`)
- Manifest(s): `package.json`, `package-lock.json`
- Old version: `@astrojs/markdown-remark` 7.3.0, `astro` 7.3.1
- New version: `@astrojs/markdown-remark` 7.3.1, `astro` 7.3.2
- Update type: patch (both released together upstream on 2026-09-08)

### Why now
Routine freshness. `astro@7.3.2` declares a `^7.3.0` dependency on `@astrojs/markdown-remark`, so both were bumped together. Verified via `npm view @ dependencies --json` vs `@` that the dependency trees are **identical** between old/new for both packages, except a transitive `@astrojs/markdown-satteri` 0.4.0 -> 0.4.1 patch bump pulled in by astro itself — confirms a pure patch/bugfix bump with no dependency-tree churn.

### Manual apply instructions
```
# in repo root
sed -i 's/"@astrojs\/markdown-remark": "7.3.0"/"@astrojs\/markdown-remark": "7.3.1"/' package.json
sed -i 's/"astro": "7.3.1"/"astro": "7.3.2"/' package.json
npm install --package-lock-only --registry=https://registry.npmjs.org/ --ignore-scripts
```
This produces a 2-file diff: `package.json` (+4/-2 lines, net) and `package-lock.json` (+43/-11 lines net) — the extra lockfile lines beyond the 2 version bumps are incidental `"dev": true` markers npm adds to unrelated optional platform-binary entries (esbuild/rollup native binaries), not a real dependency-tree change.

### Validation already performed
- `npm audit --package-lock-only --json` before/after: **identical** 5 findings (1 high, 4 moderate) both times — confirms the existing, deliberately-deferred `undici`/`@actions/github` transitive-audit issue (see PR #3980, a reviewed maintainer decision to remove the undici override) is unaffected by this bump.
- `package.json` and `package-lock.json` both confirmed valid JSON via `python3 -c "json.load(...)"`.
- `git diff origin/main HEAD --stat`: exactly 2 files changed, matching expectations, confirmed **before** each `create_pull_request` attempt.
- Full `npm ci` + `astro build` could not be completed in this sandbox: `npm ci --ignore-scripts` failed with `Exit handler never called!` (an npm/registry-mirror interaction issue in this environment), a previously documented sandbox limitation unrelated to this specific dependency change. CI on an actual PR would run the full install/build.

### Root cause: repeated `create_pull_request` failure for this repo as a self-target
Two `create_pull_request` attempts this run (default base, and with explicit `base: "main"`) both failed identically:
```
{"result":"error","error":"No changes to commit - no commits found",...}
```
despite `git log origin/main..HEAD --oneline` showing exactly 1 non-empty commit (`d346fdaf`) and `git diff origin/main HEAD --stat` showing exactly 2 files changed — verified immediately before **both** attempts.

**This is now the 3rd confirmed occurrence of this exact error for `githubnext/gh-aw-cao` specifically, when the workflow runs as a self-target (workspace root == target repo, as opposed to a separate `target/` checkout):**
1. 2026-09-10 07:55 UTC run — undici override fix, diff 41+/34- lines.
2. 2026-09-10 14:37 UTC run — astro bump (same candidate as this run), diff 50+/11- lines, resulted in a prior issue for this same candidate.
3. This run (2026-09-10 16:34 UTC) — same astro bump re-verified fresh, diff 43+/11- lines.

Three different commit SHAs, two different branch names, two different diffs of noticeably different size, same identical error every time. This strongly suggests a bug in the `create_pull_request` safe-output implementation specific to the self-target scenario for this repository, not a diff-size, content, or candidate-specific issue.

### Recommendation
- Please check whether the prior issue for this same candidate (created ~2026-09-10 14:37 UTC) is still open; if so, this issue may be a duplicate — consider consolidating.
- Investigate the `create_pull_request` safe-output implementation/dispatch path for the case where `target_repo == githubnext/gh-aw-cao` and the workflow's checked-out workspace root is used directly (no separate `target/` checkout).
- Until fixed, future dependency-release-train runs against this repo as a self-target should apply this fix manually or via a human-authored PR rather than continuing to retry `create_pull_request`.

### Control Plane
- Correlation ID: 34502184073-1006
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34502184073

> [!WARNING]
>
> Firewall blocked 4 domains
>
> The following domains were blocked by the firewall during workflow execution:
>
> - `msfeed12.pkgs.visualstudio.com`
> - `msfeed17.pkgs.visualstudio.com`
> - `msfeed2.pkgs.visualstudio.com`
> - `msfeed25.pkgs.visualstudio.com`
>
> To allow these domains, add them to the `network.allowed` list in your workflow frontmatter:
>
> ```yaml
> network:
> allowed:
> - defaults
> - "msfeed12.pkgs.visualstudio.com"
> - "msfeed17.pkgs.visualstudio.com"
> - "msfeed2.pkgs.visualstudio.com"
> - "msfeed25.pkgs.visualstudio.com"
> ```
>
> See [Network Configuration](https://github.github.com/gh-aw/reference/network/) for more information.
>
>

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34502184073) · copilot · auto · 96.6 AIC · ⌖ 22.5 AIC · ⊞ 18K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 24, 2026, 4:42 PM UTC

Start with the create_pull_request safe-output implementation and dispatch path for the self-target case described in the issue, then inspect package.json and package-lock.json for the prepared Astro dependency change. Reproduce the failure against githubnext/gh-aw-cao and compare the commit and diff checks before submission. Done means the self-target workflow creates a pull request instead of reporting no commits found.

Written by the indexing model from the issue text.