fix(ci): Correct harden-runner SHA pin in stale workflow

[frbrkoala]

The Harden Runner step pinned step-security/harden-runner to a SHA whose tail was mangled, so GitHub Actions could not resolve the action and the 'Stale issue & PR handler' workflow failed at setup. Repin to the real commit SHA for the v2.10.4 tag it was labeled as.

What does this PR do?

🛑 Please open an issue first to discuss any significant work and flesh out details/direction — we would hate for your time to be wasted.
Consult the CONTRIBUTING guide for submitting pull-requests.

Motivation

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• New blueprint (adding a new protocol — see checklist below)
• Documentation update
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Testing

• I have run npm run build successfully
• I have run npm run test and all tests pass
• I have run npx cdk synth with a sample .env (e.g. from blueprints/dummy/samples/) and it succeeds
• I have run pre-commit hooks: npm run run-pre-commit

New Blueprint Checklist (if adding a protocol)

• Blueprint follows the structure of blueprints/dummy/ (reference implementation)
• Blueprint README follows the standard template (matches Dummy section titles and ordering)
• Setup section points to Getting Started (not inline instructions)
• Deployment section leads with AI-driven deployment (Option 1) and manual as Option 2
• Sample .env files are provided for at least one network (mainnet or testnet)
• Configuration scripts follow the install/run dispatch pattern (see blueprints/dummy/)
• Blueprint page added to website/docs/blueprints/ (.mdx mirror importing README)
• Client Release Channels table added to README under Additional Resources

Documentation

• I have updated relevant documentation (if applicable)
• I have run cd website && npm run build with no broken links (if docs changed)

License

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/step-security/harden-runner	cb605e52c26070c328afc4562f0b4ada7618a84e	🟢 7.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 16 out of 16 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 13 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities ⚠️ 0 16 existing vulnerabilities detected

Scanned Files

• .github/workflows/stale-issue-pr.yml

[github-actions]

Scan for commit: c34338c | Updated: 2026-07-07 04:12:11 UTC

🔒 Security Scan Results

Scanned files: 1

⚠️ Security findings detected. Please review and address before merging.