chore(security): block merge on high-severity scanner findings

[abir-vim]

Automated fleet sync of the org security scanner. Raises BLOCK_ON_SEVERITY from critical to high so high and critical findings (and dependency BLOCK) fail the AI security scan check. Medium/low/info remain advisory. See scanner-org for the source template.

[github-actions]

Security Scanner Results

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	0	0	1	0	0

Findings

• ⚪ Security gate block threshold lowered from 'critical' to 'high' — .github/workflows/security.yml:417
  • Remediation: No action required. This is an intentional tightening of the merge gate. Confirm the team expects high-severity findings to now block merges, and be aware that any existing open PRs with high-severity findings will begin failing the required check.

Gate blocks at severity high or a dependency marked BLOCK. Full history in scanner-stats.