chore(security): block merge on high-severity scanner findings

[abir-vim]

Automated fleet sync of the org security scanner. Raises BLOCK_ON_SEVERITY from critical to high so high and critical findings (and dependency BLOCK) fail the AI security scan check. Medium/low/info remain advisory. See scanner-org for the source template.

[github-actions]

Security Scanner Results

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	0	0	1	0	5

Findings

• ⚪ PR tightens security gate to block on high-severity findings — .github/workflows/security.yml:291
  • Remediation: No action required. The change strengthens the CI gate. Optionally confirm both occurrences (summary step and gate step) stay in sync so the rendered severity table and the blocking verdict use the same threshold.

Vulnerable dependencies

• WARN immutable@3.8.1 (GHSA-v56q-mh7h-f735, GHSA-wf6x-7x77-mvgw, GHSA-xvcm-6775-5m9r)
• WARN lodash@4.17.4 (GHSA-29mw-wpgm-hmr9, GHSA-35jh-r3h4-6jhm, GHSA-4xc9-xhrj-v574, GHSA-f23m-r3pf-42rh, GHSA-fvqr-27wr-82fm, GHSA-jf85-cpcp-j695, GHSA-p6mc-m468-83gw, GHSA-r5fr-rjxr-66jc, GHSA-x5rq-j2xg-h7qm, GHSA-xxjr-mmjv-4gpg)
• WARN lodash-es@4.17.4 (GHSA-29mw-wpgm-hmr9, GHSA-35jh-r3h4-6jhm, GHSA-f23m-r3pf-42rh, GHSA-jf85-cpcp-j695, GHSA-p6mc-m468-83gw, GHSA-r5fr-rjxr-66jc, GHSA-x5rq-j2xg-h7qm, GHSA-xxjr-mmjv-4gpg)
• WARN node-fetch@1.6.3 (GHSA-r683-j2x4-v87g)
• WARN ua-parser-js@0.7.12 (GHSA-394c-5j6w-4xmx, GHSA-662x-fhqg-9p8v)

Gate blocks at severity high or a dependency marked BLOCK. Full history in scanner-stats.