ci: bump Shadow engine to v1.7 (#284)

* ci: bump Shadow engine to v1.7

Re-pin the reusable Shadow workflow from 54ec94e (v1.6) to v1.7, following the
dqdl canary (awslabs/dqdl#41, merged + soaking). v1.7 adds configurable
allowed_labels and a bot_name-branded rate-limit label; no .shadow.yml change
here, so those features stay dormant (behavior unchanged).

OIDC unaffected: the bot role's trust is sub-scoped (repo:...:*), not pinned to
the workflow ref, so the ref bump doesn't affect role assumption.

* ci: pin Shadow v1.7 by commit SHA, not the mutable tag

Address review feedback: pin the reusable workflow to the full commit SHA v1.7
points to (ed31ed7) with a '# v1.7' comment, per GitHub Actions supply-chain
hardening — a mutable tag could be re-pointed to run untrusted code with this
workflow's OIDC/secret access. Immutable + readable.

Author: sudsali

.github/workflows/issue-bot.yml

@@ -1,5 +1,5 @@
 name: Shadow   # load-bearing: auto-approve.yml keys on this exact name
-# To upgrade the engine, bump the SHA in BOTH `uses:` and `shadow_ref` below
+# To upgrade the engine, bump the ref in BOTH `uses:` and `shadow_ref` below
 # (GitHub forbids expressions in `uses:`, so they can't share a variable).
 
 on:
@@ -40,11 +40,11 @@ jobs:
       (github.event_name == 'workflow_dispatch') ||
       (github.actor != 'github-actions[bot]' &&
        (github.event.issue.pull_request == null || github.event_name == 'pull_request_target'))
-    uses: sudsali/shadow/.github/workflows/shadow-review.yml@54ec94e0ca8c90d9b58ff95a2a06b175a115784e
+    uses: sudsali/shadow/.github/workflows/shadow-review.yml@ed31ed7e30ef81be82d7b8b756b626f876036d73 # v1.7
     with:
       pr_number: ${{ inputs.issue_number }}
       dry_run: ${{ inputs.dry_run && 'true' || 'false' }}
-      shadow_ref: 54ec94e0ca8c90d9b58ff95a2a06b175a115784e
+      shadow_ref: ed31ed7e30ef81be82d7b8b756b626f876036d73 # v1.7
       aws_region: us-east-1
       prompt_sm_prefix: pydeequ-bot
     secrets: