feat(security): resolve 8 code-scanning alerts (Alerts 1, 3, 4, 5, 6, 7, 20, 21)

- Delete stale AI task file (Alert 1)
- SHA-pin security-scan workflow (Alert 3)
- Use String.to_existing_atom in VQLTypeChecker (Alert 4)
- Use [:safe] option in binary_to_term calls (Alerts 5, 6)
- Upgrade insecure mongodb-init URL to HTTPS (Alert 7)
- Suppress SDK-structural Obj.magic/decode escapes with documentation (Alerts 20, 21)

Author: hyperpolymath

.github/workflows/security-scan.yml

@@ -14,6 +14,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@main
+    uses: hyperpolymath/panic-attacker/.github/workflows/scan-and-report.yml@35fb302b0bcd797ba304bcc30def77fcb18cc3db # main 2026-05-20
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}