Restore canonical detection-needs-pat_pool manual patch

Address Copilot review comment on PR #128832: the rewritten manual-patch
comment referenced a phantom 'ci-scan.lock.yml' file that does not exist
(only ci-failure-scan.lock.yml and ci-failure-scan-feedback.lock.yml
carry this patch).

The recompile during this PR also moved the comment block into the middle
of the 'needs:' list (between '- agent' and '- pat_pool') and dropped the
upstream tracking reference (gh-aw issue #30232) and the user-visible
symptom (the 'Security scanning requires review' CAUTION banner).

Restore the canonical comment verbatim from ci-failure-scan.lock.yml so
both lock files carry identical, accurate patch documentation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Milos Kotlar