Block scan remediation until patched gh-aw-mcpg image is published

[Copilot]

The container scan reported High vulnerabilities on ghcr.io/github/gh-aw-mcpg:v0.4.7 (pinned by digest). This update confirms the repo’s pinning surface and verifies that no patched upstream image is currently available to safely bump to.

• Problem scope

  • Confirmed gh-aw-mcpg:v0.4.7@sha256:7545220a9aca... is pinned in shared lock data (.github/aw/actions-lock.json) and mirrored generated pin data (pkg/*/data/action_pins.json).

• Upstream availability check

  • Verified upstream github/gh-aw-mcpg latest release is still v0.4.7.
  • Verified GHCR latest resolves to the same digest as v0.4.7, so there is no newer patched image digest to adopt yet.

• Change outcome

  • No pin change is applied in this PR to avoid a non-remediating version churn.
  • Follow-up is unblocked once a patched gh-aw-mcpg tag/digest is published.

"ghcr.io/github/gh-aw-mcpg:v0.4.7": {
  "digest": "sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00",
  "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.4.7@sha256:7545220a9aca134b71e51193ee0eaf4c50756ebf8fbd25a63ae7556e62815c00"
}

• Fixes [container-image-scan] Container findings for ghcr.io/github/gh-aw-mcpg:v0.4.7 #49508