chore(security): block merge on high-severity scanner findings

[abir-vim]

Automated fleet sync of the org security scanner. Raises BLOCK_ON_SEVERITY from critical to high so high and critical findings (and dependency BLOCK) fail the AI security scan check. Medium/low/info remain advisory. See scanner-org for the source template.

[github-actions]

Security Scanner Results

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	0	0	1	0	0

Findings

• ⚪ Security gate threshold tightened from critical to high — .github/workflows/security.yml:291
  • Remediation: No remediation required. This is a defensive hardening change. Verify that the stricter threshold matches team policy, since existing PRs carrying high-severity findings that previously passed will now be blocked.

Gate blocks at severity high or a dependency marked BLOCK. Full history in scanner-stats.