bridge-gate.yml builds panic-attack from moving main (unpinned scanner, CWE-829) #481

What

.github/workflows/bridge-gate.yml builds its scanner like this:

git clone --depth 1 https://github.com/hyperpolymath/panic-attack /tmp/pa
cargo build --release --features http --manifest-path /tmp/pa/Cargo.toml

That takes whatever is on panic-attack main at run time. The same commit can therefore pass or fail depending on when it runs, and a change pushed to panic-attack runs inside echidna's CI without review here. This is the pattern hyperpolymath/panic-attack#212 fixed for scan-and-report.yml.

static-analysis-gate.yml already does this properly:

• pins PANIC_ATTACK_REF to a full SHA;
• builds with cargo install --git … --rev "$PANIC_ATTACK_REF" --locked;
• checks .crates.toml names that rev;
• records the binary digest.

The Patch Bridge report schema has also moved: 0.2.0 → 0.3.0 adds vulnerability_data. This job's B1 verdict step should only trust a report whose feed was queried.

Acceptance criteria

• bridge-gate.yml builds panic-attack at the same pinned PANIC_ATTACK_REF as static-analysis-gate.yml, or reuses that job's preserved panic-attack-toolchain artifact. No build from a moving ref remains.
• The B1 verdict refuses a report whose vulnerability_data is not queried.

Found while working on #478.