Security suite failed (main @ 12c9b63)

The root `mise run security` suite failed in GitHub Actions. Use the log tail below and reproduce locally with the same command.

| Field | Value |
| --- | --- |
| Workflow run | [Security #23](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/actions/runs/34120514441) |
| Ref | `refs/heads/main` |
| SHA | [`12c9b63f8aed72880156d8a22c5b87811bb08445`](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/commit/12c9b63f8aed72880156d8a22c5b87811bb08445) |
| Actor | @krokoko |
| Event | `schedule` |

### Log tail (last 200 lines)

```text
mise WARN deprecated [config.experimental_monorepo_root]: `experimental_monorepo_root` in ~/work/sample-autonomous-cloud-coding-agents/sample-autonomous-cloud-coding-agents/mise.toml is deprecated. Use `monorepo_root` instead. This will be removed in mise 2027.12.0.
[//:security:secrets] $ gitleaks git . --no-banner --redact --log-opts="HEAD"
12:13PM INF 305 commits scanned.
12:13PM INF scanned ~23861274 bytes (23.86 MB) in 2.84s
12:13PM INF no leaks found
[//:security:deps] $ osv-scanner scan --lockfile agent/uv.lock --lockfile yarn.lock --lockfile integrations/jira-forge-app/package-lock.json
Starting filesystem walk for root: /
Scanned /home/runner/work/sample-autonomous-cloud-coding-agents/sample-autonomous-cloud-coding-agents/agent/uv.lock file and found 129 packages
Scanned /home/runner/work/sample-autonomous-cloud-coding-agents/sample-autonomous-cloud-coding-agents/yarn.lock file and found 1194 packages
Scanned /home/runner/work/sample-autonomous-cloud-coding-agents/sample-autonomous-cloud-coding-agents/integrations/jira-forge-app/package-lock.json file and found 52 packages
End status: 0 dirs visited, 3 inodes visited, 3 Extract calls, 37.882668ms elapsed, 37.882748ms wall time

No issues found
[//:security:sast] $ semgrep scan --config auto --config p/python --config p/typescript --config p/owasp-top-ten --config p/security-audit --error --quiet .


┌────────────────┐
│ 1 Code Finding │
└────────────────┘

cdk/src/handlers/linear-webhook-processor.ts
❯❱ javascript.lang.security.insecure-object-assign.insecure-object-assign
❰❰ Blocking ❱❱
Depending on the context, user control data in `Object.assign` can cause web response to include
data that it should not have or can lead to a mass assignment vulnerability.
Details: https://sg.run/2R0D

926┆ Object.assign(channelMetadata, vaultMetadata(resolved));

[//:security:sast] ERROR task failed
```

Close this issue after `mise run security` succeeds on `main` (or the branch you merge to).

Start by running `mise run security` and inspect the Semgrep finding at line 926 of `cdk/src/handlers/linear-webhook-processor.ts`, especially the `Object.assign(channelMetadata, vaultMetadata(resolved))` call. Reproduce the failure locally, then rerun the same command; done means the security suite succeeds on `main` or the merge target.

Written by the indexing model from the issue text.