The old pin (fd60e4c9) installs unpinned latest ruff; 0.16.0 flags
pre-existing code (BLE001 etc.), failing ci / ci on every PR — currently
blocking Dependabot #37. The org workflow pinned ruff to 0.15.22 on
2026-07-23 (f71002a9); this picks that up along with setup-action bumps,
contents:read scoping, and SHA-pinned third-party actions.
Add the org reusable labeler caller (callable-labeler.yaml@main) and a
static badge block (CI status, Python, AWS SAM, Slack) under the README
H1. Part of the INFRA-47 GitHub-hygiene rollout.
* Add dependency-review caller workflow
Add a pull_request-triggered caller that invokes the org-level
callable-dependency-review workflow to scan dependency changes and
fail on high-severity advisories.
* chore: retrigger checks
* chore: retrigger dep review (post-fix)
