chore(security): pin claude-code-action to known-good v1.0.174

[abir-vim]

Automated fleet sync of the org security scanner. Pins claude-code-action off the floating @v1 tag (which regressed at v1.0.175+ and silently no-ops on Bedrock, failing the scan gate closed) to the known-good SHA. See scanner-org for the source template.

[github-actions]

Security Scanner Results

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	0	1	1	0	0

Findings

• 🔵 allowed_bots: "*" lets any bot-authored PR trigger the security scan — .github/workflows/security.yml:170
  • Remediation: Pin allowed_bots to the specific automation you actually use (e.g. "dependabot[bot],renovate[bot],gitops[bot]") instead of "*", so an unexpected bot identity cannot trigger scanner runs.
• ⚪ Broadening triggers to bots widens prompt-injection surface from PR diff content — .github/workflows/security.yml:171
  • Remediation: Treat model-produced findings.json as untrusted: the deterministic gate/summary steps already own the verdict, which is correct. Additionally narrow allowed_bots (see over-broad-bot-allowlist) to reduce who can feed injected diff content, and keep the tool allowlist minimal.

Gate blocks at severity critical or a dependency marked BLOCK. Full history in scanner-stats.