chore(security): pin claude-code-action to known-good v1.0.174

[abir-vim]

Automated fleet sync of the org security scanner. Pins claude-code-action off the floating @v1 tag (which regressed at v1.0.175+ and silently no-ops on Bedrock, failing the scan gate closed) to the known-good SHA. See scanner-org for the source template.

[github-actions]

Security Scanner Results

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	0	0	1	0	0

Findings

• ⚪ GitHub Action pinned from floating @v1 tag to an immutable commit SHA — .github/workflows/security.yml:156
  • Remediation: No action needed — keep actions pinned to full commit SHAs. As a follow-up, confirm the pinned SHA truly corresponds to the claimed release (v1.0.174) in the upstream anthropics/claude-code-action repository, and adopt an automated pin-updater (e.g. Dependabot/Renovate configured to pin to SHAs) so pins are refreshed deliberately.

Gate blocks at severity critical or a dependency marked BLOCK. Full history in scanner-stats.