chore(security): pin claude-code-action to known-good v1.0.174

[abir-vim]

Automated fleet sync of the org security scanner. Pins claude-code-action off the floating @v1 tag (which regressed at v1.0.175+ and silently no-ops on Bedrock, failing the scan gate closed) to the known-good SHA. See scanner-org for the source template.

[github-actions]

Security Scanner Results

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	1	1	0	0	0

Findings

• 🟡 allowed_bots: "*" lets any bot actor trigger the LLM security scanner — .github/workflows/security.yml:170
  • Remediation: Replace allowed_bots: "*" with an explicit comma-separated allowlist of the trusted bot logins you actually need (e.g. "dependabot[bot],renovate[bot],gitops[bot]") so only vetted automations can trigger the scanner. Re-evaluate if new trusted bots are added.
• 🔵 Attacker-influenced PR diff flows into the scanner LLM, whose findings.json drives the gate verdict — .github/workflows/security.yml:170
  • Remediation: Treat the scan as advisory-with-defense-in-depth: keep independent deterministic gates (OSV/dependency BLOCK, secret scanning) that do not depend on model output, and consider instructing the model to treat diff contents strictly as untrusted data to analyze rather than as instructions. Monitor findings.json for anomalous empties via scanner-stats.

Gate blocks at severity critical or a dependency marked BLOCK. Full history in scanner-stats.