ci(scanner): add required plugin security gate

Run the canonical HOL AI Plugin Scanner on pushes and pull requests with the thresholds required by the Awesome AI Plugins contribution gate.\n\nThe implementation follows docs/specs/2026-08-14-ai-plugin-scanner-ci.md and was validated with parsed workflow-contract assertions plus the six doc-link graph tests. This addresses the missing scanner evidence reported on upstream PR #74.\n\nCo-authored-by: Codex (GPT 5.6 Sol) <codex@openai.com>

Author: phodal

.github/workflows/plugin-security-scan.yml

@@ -0,0 +1,24 @@
+name: Plugin Security Scan
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Scan AI plugin repository
+        uses: hashgraph-online/ai-plugin-scanner-action@55616c962cf86368423f7673b2ecdfdbe613d1af # v1
+        with:
+          plugin_dir: "."
+          mode: scan
+          min_score: 80
+          fail_on_severity: high
+          pr_comment: "off"

docs/specs/2026-08-14-ai-plugin-scanner-ci.md

@@ -0,0 +1,48 @@
+# AI plugin scanner CI
+
+## Traceability
+
+- Spec ID: ai-plugin-scanner-ci
+- Status: Implemented
+
+## Intent
+
+Run the HOL AI Plugin Scanner in GitHub Actions so repository changes receive
+the security and publishability gate required by the Awesome AI Plugins
+contribution process.
+
+## Acceptance Scenarios
+
+- AC-1: A push starts a workflow that scans the repository root in `scan` mode.
+- AC-2: A pull request starts the same scanner workflow.
+- AC-3: The scanner fails when the score is below 80 or a high-or-greater
+  severity finding is present.
+- AC-4: The workflow invokes the canonical
+  `hashgraph-online/ai-plugin-scanner-action` action and is accepted by the
+  upstream contribution gate.
+
+## Non-goals
+
+- Changing scanner findings unrelated to installing the required CI gate.
+- Enabling SARIF upload, automated submissions, or pull-request comments.
+- Changing existing CI, release, or Pages workflows.
+
+## Plan and Tasks
+
+1. Add a least-privilege workflow under `.github/workflows/` for pushes and
+   pull requests.
+2. Pin the checkout and scanner actions while retaining the scanner's `v1`
+   compatibility annotation for reviewability.
+3. Configure the repository root, scan mode, score threshold, and severity
+   threshold required by the upstream contribution gate.
+4. Validate the workflow structure locally, then observe the pushed GitHub
+   Actions run and the upstream contribution gate.
+
+## Test and Review Evidence
+
+- AC-1, AC-2: Parse the workflow and inspect the declared event keys.
+- AC-3, AC-4: Parse the scanner step and assert its action identity and four
+  required input values.
+- AC-1 through AC-4: Push the workflow and inspect its GitHub Actions result.
+- Risk: The scanner may expose pre-existing findings. Those findings remain
+  visible follow-up work rather than being hidden or weakened by this change.