actions.lock: security-scan.yml's reusable panic-attack ref is out of sync (lock-sync gate red on main)

[hyperpolymath]

actions.lock is in sync with the workflow YAML (scripts/check-lock-sync.sh) is red on main:

• .github/workflows/security-scan.yml calls hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@5e75753… (and Dependabot PR chore(deps): bump hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml from 5e7575340961a21098d8d9600461038897016a4d to acdb9821a67fe0a275b39f1b388be364df7fbd4a in the actions group #294 bumps it to @acdb982…).
• The lock's .github/workflows/security-scan.yml key and its dependencies: record still name hyperpolymath/panic-attack@27b3d93….

gh actions-lock (default, --no-narrow, --no-migrate-local-actions, --relock --rescan) does not update job-level reusable-workflow refs; the script's own remediation text says this record must be corrected by hand. Hand edits to actions.lock are denied to agents on this estate, so this needs a human edit, or a fix to gh actions-lock.

Acceptance criteria

• The lock's security-scan.yml entry and dependencies: record name the same panic-attack SHA that security-scan.yml pins.
• ./scripts/check-lock-sync.sh exits 0 on main.
• gh actions-lock --no-fix still exits 0.

Found while working #294.

🤖 Generated with Claude Code