ci: bump Shadow engine to v1.7

Re-pin the reusable Shadow workflow from 54ec94e (v1.6) to v1.7, following the
dqdl canary (awslabs/dqdl#41, merged + soaking). v1.7 adds configurable
allowed_labels and a bot_name-branded rate-limit label; no .shadow.yml change
here, so those features stay dormant (behavior unchanged).

OIDC unaffected: the bot role's trust is sub-scoped (repo:...:*), not pinned to
the workflow ref, so the ref bump doesn't affect role assumption.

Author: sudsali

.github/workflows/issue-bot.yml

@@ -1,5 +1,5 @@
 name: Shadow   # load-bearing: auto-approve.yml keys on this exact name
-# To upgrade the engine, bump the SHA in BOTH `uses:` and `shadow_ref` below
+# To upgrade the engine, bump the ref in BOTH `uses:` and `shadow_ref` below
 # (GitHub forbids expressions in `uses:`, so they can't share a variable).
 
 on:
@@ -40,11 +40,11 @@ jobs:
       (github.event_name == 'workflow_dispatch') ||
       (github.actor != 'github-actions[bot]' &&
        (github.event.issue.pull_request == null || github.event_name == 'pull_request_target'))
-    uses: sudsali/shadow/.github/workflows/shadow-review.yml@54ec94e0ca8c90d9b58ff95a2a06b175a115784e
+    uses: sudsali/shadow/.github/workflows/shadow-review.yml@v1.7
     with:
       pr_number: ${{ inputs.issue_number }}
       dry_run: ${{ inputs.dry_run && 'true' || 'false' }}
-      shadow_ref: 54ec94e0ca8c90d9b58ff95a2a06b175a115784e
+      shadow_ref: v1.7
       aws_region: us-east-1
       prompt_sm_prefix: deequ-bot
     secrets: