Add mcp-safety-scanner CI

[TheodorNEngoy]

Adds a lightweight MCP/tool-server safety scan in CI using TheodorNEngoy/mcp-safety-scanner@v0 (JS/TS/Python/Go heuristics).\n\n- Runs on PRs + pushes to main\n- Fails only on high+ severity\n- Emits GitHub annotations for findings

[TheodorNEngoy]

Note: GitHub Actions checks may not auto-run for fork PRs until a maintainer approves them. This workflow just runs TheodorNEngoy/mcp-safety-scanner@v0 with read-only access (no secrets). If you click "Approve and run" it should go green.

[jonathanhefner]

Thank you for the PR, but I am not comfortable accepting this into our CI workflow.

[TheodorNEngoy]

Totally understand. Could you share what specifically makes you uncomfortable (third-party Action in CI, false positives/noise, added maintenance, etc.)?\n\nIf it helps, I can change direction and either:\n- make this docs-only (no CI),\n- recommend pinning to a full semver tag or commit SHA, or\n- provide a tiny vendorable script so the repo doesn't depend on an external Action.\n\nNo worries either way, thanks for taking a look.