.github/workflows/agent-team-apply-verify.yml

@@ -136,7 +136,7 @@ jobs:
     permissions: {}
     steps:
       - name: Harden runner (block egress; no secrets present)
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -195,7 +195,7 @@ jobs:
       diff_hash: ${{ steps.verify.outputs.diff_hash }}
     steps:
       - name: Harden runner (egress audit; no secrets present anyway)
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: block
           # Only what fetching the artifact + GitHub API needs. The job holds
@@ -605,7 +605,7 @@ jobs:
       contents: read
     steps:
       - name: Harden runner (block egress — untrusted code runs here)
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           # Block, not audit: this is where untrusted patch code executes. A
           # narrow allowlist for dependency resolution only; everything else is
@@ -1102,7 +1102,7 @@ jobs:
       # workflow uses a GitHub App installation token only, no cloud provider.
     steps:
       - name: Harden runner (privileged job; block egress)
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           # DEPLOY: this allowlist is GitHub API only (App-token mint + gh pr
           # create). Trim/confirm per target repo at provisioning — an