[uk-ai-resilience] Stale code-scanning alert #653 not dismissed despite remediated actionlint/gosec binaries (Tier C)

### Tier and Risk-Scoring Summary

**Tier: C — Restricted Pending Review** (process gap, not a live vulnerability)

| Dimension | Score |
|---|---|
| Exposure Amplification | Low |
| Patchability | High (process fix only) |
| Detectability | Low (masked by noise — 40 open security-labeled issues, mostly recurring automated bot reports) |
| Operational Fragility | Medium (alert fatigue risk) |
| Ownership Confidence | Low (no clear alert-lifecycle owner) |

### Finding

Code-scanning alert [#653](https://github.com/github/gh-aw/security/code-scanning/653) (`workflow-out-of-context`, Malicious Code Scanner) remains **open**, but it references ~78MB of `actionlint`/`gosec` binaries originally committed via PR #48979. These binaries were verified (via `git ls-files`) to **no longer exist** in the current tree, and at least 6 remediation issues addressing this exact finding are already closed: #52527, #53738, #50602, #50617, #52540, #53764.

This indicates the code-scanning alert was never dismissed/closed after the underlying issue was remediated — a **triage/dismissal process gap**, not a security defect. Left unaddressed, this contributes to alert fatigue: with 40 open security-labeled issues (many recurring automated reports from sighthound, vulnhunter, static-analysis, container-image-scan, domains-audit workflows), stale alerts like this dilute signal-to-action ratio and risk masking genuinely new findings.

### Remediation Action

- Dismiss/close alert #653 as fixed (binaries removed, confirmed via `git ls-files`).
- Add a process check (e.g., in the code-scanning-fixer or a periodic housekeeping workflow) to auto-verify and dismiss alerts once their linked remediation issue is closed, to prevent recurrence of stale open alerts.

**SLA Urgency: Medium**

### Discussion Report

Full UK AI Open Code Risk & Resilience governance report: see the linked discussion "UK AI Governance: Weekly Resilience Report — 2026-09-01" created in this same workflow run.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/33527665098) · copilot · auto · 65.5 AIC · ⌖ 8.45 AIC · ⊞ 8.1K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)

Start by reviewing code-scanning alert #653 and verifying with git ls-files that the actionlint and gosec binaries are absent. Read the closed remediation issues #52527, #53738, #50602, #50617, #52540, and #53764, then inspect the code-scanning-fixer or periodic housekeeping workflow if present. Done means the stale alert is dismissed and recurrence prevention is addressed.

Written by the indexing model from the issue text.