Warden Sweep 7d5ea73d: 7 findings across 267 files

## Warden Sweep `7d5ea73d`

| Metric | Count |
|--------|-------|
| Files scanned | 267 |
| Files timed out | 1 |
| Files errored | 0 |
| Total findings | 28 |
| Verified | 7 |
| Rejected | 21 |

### Verified Findings

| Severity | Skill | File | Title |
|----------|-------|------|-------|
| **HIGH** | sentry-security | `src/sentry/auth/access.py:1065` | SentryApp installations with PENDING or PENDING_DELETION status can access organizations |
| MEDIUM | sentry-security | `src/sentry/auth/staff.py:336` | Staff cookie not properly deleted due to missing path and domain parameters |
| **HIGH** | sentry-security | `src/sentry/auth_v2/endpoints/auth_merge_user_accounts.py:67` | Verification token expiration not validated, allowing expired tokens to authorize account merges |
| **HIGH** | sentry-security | `src/sentry/middleware/integrations/parsers/gitlab.py:49` | Webhook secret validation bypassed in control silo, enabling DoS and resource exhaustion |
| MEDIUM | sentry-security | `src/sentry/web/frontend/base.py:343` | Inactive superuser session can bypass organization auth flow |
| MEDIUM | sentry-security | `src/sentry/web/frontend/group_plugin_action.py:23` | Plugin action endpoint allows invoking disabled plugins |
| **HIGH** | sentry-security | `src/sentry/web/frontend/idp_email_verification.py:20` | Email verification token can be reused multiple times (token replay attack) |

### Skills Run

sentry-security

> Generated by Warden Sweep. PRs referencing this issue will appear below.

Start by reviewing the seven listed entry points, including src/sentry/auth/access.py:1065, src/sentry/auth_v2/endpoints/auth_merge_user_accounts.py:67, and the webhook, session, plugin, and email-verification files. Trace each reported security finding and check the relevant existing tests or request flows. Done means every verified finding has a confirmed resolution and regression coverage.

Written by the indexing model from the issue text.