fix(agents): pin security analyzer to Sonnet 5

[DevSecNinja]

Summary

• Replace the retired model: "Claude Sonnet 4.6" selection with the explicitly approved model: "Claude Sonnet 5" in .github/agents/sast-sca-security-analyzer.agent.md.
• Preserve the agent's tools, prompt, and all other frontmatter unchanged. No platform-default selection or silent fallback is introduced.
• Change only this one model line; leave dependency provenance and unrelated model selections untouched.

Verification

• bash tests/validate-prompts.sh passes, including the existing pre-commit hook.
• bash scripts/generate-index.sh succeeds with no generated catalog changes.
• Targeted frontmatter/tool-list checks pass; comparison against remote main confirms all other agent content is unchanged.
• git diff --check passes; tracked-file search finds no remaining Sonnet 4.6 references.
• No live billable model calls or security review were performed.

APM regeneration caveat

This agent is materialized from the SHA-pinned github/awesome-copilot dependency. There is no repo-owned source copy or model override for it. A future APM materialization may restore the upstream retired pin; review the resulting materialization PR for that regression. This PR intentionally leaves apm.yml and apm.lock.yaml unchanged.

Summary by CodeRabbit

• Chores
  • Updated the security analysis agent to use a newer AI model.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1d65d0bf-e3a3-4e6b-ad66-3c8648b16284

📥 Commits

Reviewing files that changed from the base of the PR and between fd5c8ae and b6af626.

📒 Files selected for processing (1)

• .github/agents/sast-sca-security-analyzer.agent.md

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The security analyzer agent configuration now specifies Claude Sonnet 5 instead of Claude Sonnet 4.6.

Changes

Security analyzer configuration

Layer / File(s)	Summary
Update configured model .github/agents/sast-sca-security-analyzer.agent.md	The agent configuration changes its model from Claude Sonnet 4.6 to Claude Sonnet 5.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to b6af6

The change is limited to the security analyzer’s configured model. No actionable merge-blocking behavior is established by the available evidence.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning the security analyzer to Sonnet 5.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}