fix(ci): scan agent bot prompts

[devi-labs]

Summary

• add Shopify Security Scan block-mode headers to the remaining Claude agent workflows
• explicitly remind the agents to treat issue/PR/review/comment and repo content as untrusted

Testing

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/agent-bot.yml"); YAML.load_file(".github/workflows/agent-android-bot.yml"); puts "yaml ok"'
• confirmed all agent*.yml workflows using claude-code-action have Shopify-Security-Scan-Mode: block