docs: name composite actions in SECURITY.md's CodeQL scan scope

[hivecommons-hive]

Documentation Fix

SECURITY.md's Scope section said CodeQL scans "the GitHub Actions workflows (the actions language)" — omitting the composite actions under .github/actions/, which the actions language matrix entry has analyzed since #1619 (workflow triggers on .github/actions/**; the workflow's inline comment documents composite-action analysis). A reader of the security policy could conclude the shipped composite actions (setup-node-deps) are outside the scan.

This PR updates the two Scope sentences to name composite actions alongside workflows, matching what codeql.yml already does and documents. Exact cluster claimed: SECURITY.md Scope paragraph only — no overlap with any open hold-gated PR (none touch SECURITY.md).

Fixes #1637

---

Filed by guide agent (ACMM L5 — hold-gated mode). Hold-gated: human review required.

— hive: agent=guide backend=copilot model=kimi-k3 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "guide" agent while Hive policy required a human checkpoint for that agent. Agent PRs are held at ACMM L3–L5; an outreach PR that targets a repository this hive does not manage is held at every level because it publishes project-facing communication into someone else's project.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[netlify]

✅ Deploy Preview for endusers ready!

Name	Link
🔨 Latest commit	278b50c
🔍 Latest deploy log	https://app.netlify.com/projects/endusers/deploys/6ad62367f077a83cd1fb0340
😎 Deploy Preview	https://deploy-preview-1638--endusers.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

7ac3a96

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 7ac3a960afd7) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • SECURITY.md
• security_policy_edit — edits security policy, scanner config, rulesets or hooks (Edits SECURITY.md, dependabot/CodeQL config, rulesets or git hooks)
  • SECURITY.md

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Lint repository / Check formatting is red on this head: npx prettier --check . flags SECURITY.md (run 39211006627). Fix: run npm run fix:format locally and push the result — no logic change needed. Branch belongs to the guide lane, so leaving this here rather than pushing.

[mrbobbytables]

The documentation change is appropriate, but the current required Lint repository check fails because Prettier rejects SECURITY.md. Please run the repository formatter and update the branch; keep this PR out of the merge queue until the required lint check is green.

[mrbobbytables]

Updated this branch in 278b50c by formatting SECURITY.md with Prettier only. npm run check:format passes locally; required CI is running. The PR remains unmerged and its hold label is unchanged.

[hivecommons-hive]

278b50c

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head 278b50c99ce7) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • SECURITY.md
• security_policy_edit — edits security policy, scanner config, rulesets or hooks (Edits SECURITY.md, dependabot/CodeQL config, rulesets or git hooks)
  • SECURITY.md

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[mrbobbytables]

The SECURITY.md formatting-only correction addresses the failing lint check, and all required checks now pass. I am leaving the existing hold label in place; this is not a request to merge.