ci: pin Ladon reviewer action

Author: bokelley

.github/workflows/ai-review.yml

@@ -34,6 +34,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Mint App token (for the workflow-mod gate comment)
         id: app-token
@@ -91,9 +92,9 @@ jobs:
 
       - name: Run Ladon
         if: steps.workflow-mod.outputs.modified != 'true'
-        # Floating v1 is intentional: Ladon is the centrally maintained AdCP
-        # reviewer, and consuming current v1 fixes is the purpose of this migration.
-        uses: adcontextprotocol/actions/ladon/review@ladon/review/v1 # zizmor: ignore[unpinned-uses]
+        # Pin the shared reviewer because this step receives the Secretariat
+        # private key and Anthropic API key. Update from ladon/review/v1 deliberately.
+        uses: adcontextprotocol/actions/ladon/review@2b4b3aa89fee5c91ccfc1ba9fc93a6bea3907d44 # ladon/review/v1
         with:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
           app-id: ${{ secrets.SECRETARIAT_APP_ID }}