Security suite failed (main @ 5e10038)

The root `mise run security` suite failed in GitHub Actions. Use the log tail below and reproduce locally with the same command.

| Field | Value |
| --- | --- |
| Workflow run | [Security #24](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/actions/runs/34842090188) |
| Ref | `refs/heads/main` |
| SHA | [`5e10038c7e28179b302ac4de78b709795aeba3ce`](https://github.com/aws-samples/sample-autonomous-cloud-coding-agents/commit/5e10038c7e28179b302ac4de78b709795aeba3ce) |
| Actor | @krokoko |
| Event | `schedule` |

### Log tail (last 200 lines)

```text
[//:security:secrets] $ gitleaks git . --no-banner --redact --log-opts="HEAD"
12:13PM INF 311 commits scanned.
12:13PM INF scanned ~24128988 bytes (24.13 MB) in 2.56s
12:13PM INF no leaks found
[//:security:deps] $ osv-scanner scan --lockfile agent/uv.lock --lockfile yarn.lock --lockfile integrations/jira-forge-app/package-lock.json
Starting filesystem walk for root: /
Scanned /home/runner/work/sample-autonomous-cloud-coding-agents/sample-autonomous-cloud-coding-agents/agent/uv.lock file and found 129 packages
Scanned /home/runner/work/sample-autonomous-cloud-coding-agents/sample-autonomous-cloud-coding-agents/yarn.lock file and found 1212 packages
Scanned /home/runner/work/sample-autonomous-cloud-coding-agents/sample-autonomous-cloud-coding-agents/integrations/jira-forge-app/package-lock.json file and found 52 packages
End status: 0 dirs visited, 3 inodes visited, 3 Extract calls, 34.35177ms elapsed, 34.351837ms wall time

No issues found
[//:security:sast] $ semgrep scan --config auto --config p/python --config p/typescript --config p/owasp-top-ten --config p/security-audit --error --quiet .


┌────────────────┐
│ 1 Code Finding │
└────────────────┘

cdk/src/handlers/linear-webhook-processor.ts
❯❱ javascript.lang.security.insecure-object-assign.insecure-object-assign
❰❰ Blocking ❱❱
Depending on the context, user control data in `Object.assign` can cause web response to include
data that it should not have or can lead to a mass assignment vulnerability.
Details: https://sg.run/2R0D

926┆ Object.assign(channelMetadata, vaultMetadata(resolved));

[//:security:sast] ERROR task failed
```

Close this issue after `mise run security` succeeds on `main` (or the branch you merge to).

Start in cdk/src/handlers/linear-webhook-processor.ts at line 926 and reproduce the failure with `mise run security`. Review the `Object.assign(channelMetadata, vaultMetadata(resolved))` usage and the surrounding webhook processing, then make the security scan pass without changing intended behavior. Confirm completion by rerunning `mise run security` successfully on the target branch.

Written by the indexing model from the issue text.