chore: use grok-build-0.1 for SquidGate

[DotNetRussell]

Point SquidGate at xAI grok-build-0.1 (custom provider, api.x.ai). Uses LLM_API_KEY repo secret.

[github-actions]

🛡️ Security Scan Results

The changes add a GitHub workflow using an unpinned third-party action, creating a supply chain security risk for the passed LLM secret and granted permissions.

MEDIUM — Unpinned third-party GitHub Action

File: .github/workflows/squidgate.yml:21 | Confidence: high | Category: supply_chain

The workflow references the external action 'SquidSec/SquidGate@v1' using a mutable version tag instead of a specific commit SHA. This introduces supply chain risk because the tag can be moved to point to malicious code, potentially exfiltrating the LLM_API_KEY secret or abusing the write permissions on pull-requests and checks.

CWE: CWE-829 | OWASP: N/A

Recommendation: Pin the action to an immutable commit SHA, e.g. uses: SquidSec/SquidGate@. Apply the same pinning to actions/checkout@v4.

---