The four refs pointed at fd60e4c9 with a '# main' comment. That comment
names a branch, so Dependabot rendered its bump PR titles as two full
40-character SHAs. Sea-Haven-Industries/.github now publishes tags.
Repoints all four at 2fbfb2e (v1.0.0) and replaces the comment with the
version. Deliberately v1.0.0 rather than the current v1.0.2, so a
Dependabot run has a newer version to find.