chore(security): pin claude-code-action to known-good v1.0.174

[abir-vim]

Automated fleet sync of the org security scanner. Pins claude-code-action off the floating @v1 tag (which regressed at v1.0.175+ and silently no-ops on Bedrock, failing the scan gate closed) to the known-good SHA. See scanner-org for the source template.

[cloudflare-workers-and-pages]

Deploying theme-editor-deploy with    Cloudflare Pages

Latest commit:	483c95d
Status:	✅  Deploy successful!
Preview URL:	https://8c3e7e1a.theme-editor-deploy.pages.dev
Branch Preview URL:	https://chore-scanner-harden.theme-editor-deploy.pages.dev

View logs

[github-actions]

Security Scanner Results

Critical	High	Medium	Low	Info	Dep BLOCK	Dep WARN
0	0	0	1	1	0	0

Findings

• 🔵 allowed_bots: "*" lets any bot trigger the scanner job (has pull-requests:write + issues:write) — .github/workflows/security.yml:170
  • Remediation: Prefer an explicit allowlist of the bots you actually rely on (e.g. allowed_bots: "renovate[bot],dependabot[bot],gitops[bot]") instead of *, so a newly introduced or compromised bot identity cannot silently trigger the writable scan job.
• ⚪ PR modifies only the security-scanner workflow; no application code or dependencies changed — .github/workflows/security.yml:195
  • Remediation: No action required; noted for completeness.

Gate blocks at severity critical or a dependency marked BLOCK. Full history in scanner-stats.