ci: add HOL plugin scanner workflow (SHA-pinned) per awesome-codex-plugins spec

Both actions pinned to commit SHAs: actions/checkout v4.2.2 and
hashgraph-online/ai-plugin-scanner-action v1 (v1.2.515). Gate matches the
submission spec: min_score 80, fail on high severity, SARIF upload.
Local scanner baseline: 100/100 (A), zero findings.

Co-Authored-By: CRHQ <noreply@crhq.ai>

.github/workflows/hol-plugin-scanner.yml

@@ -0,0 +1,27 @@
+name: HOL Plugin Scanner
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: HOL Plugin Scanner
+        uses: hashgraph-online/ai-plugin-scanner-action@55616c962cf86368423f7673b2ecdfdbe613d1af # v1 (v1.2.515)
+        with:
+          plugin_dir: "."
+          mode: scan
+          min_score: 80
+          fail_on_severity: high
+          format: sarif
+          upload_sarif: true