Add Sentinel CI workflow for workflow security scanning

[jpr5]

Summary

• Adds .github/workflows/sentinel.yml running jpr5/sentinel on PRs and pushes to main
• Configured in warn-only mode (fail-on-findings: false) with severity: high
• Part of org-wide Sentinel rollout for GitHub Actions workflow security scanning

Details

Sentinel scans CI workflow files for security anti-patterns (credential exposure, injection risks, overly broad permissions, etc.). This initial rollout uses warn-only mode so findings appear as annotations without blocking merges.

Spec: https://www.notion.so/copilotkit/3683aa381852818bacd8e14eb7233c22

Test plan

• Verify workflow triggers on this PR
• Confirm scan completes without errors
• Review any initial findings as annotations

[jpr5]

Force-pushed with SHA-pinned actions to satisfy zizmor's unpinned-uses rule. Per the org-wide sentinel rollout, the floating-tag-for-easy-updates model is being replaced with SHA-pin + dependabot. Spec updated. Rest of the PR unchanged.

[jpr5]

Promoted to blocking mode — this repo had zero sentinel findings on the warn-only scan, so we're skipping the 7-day warn-only observation period. fail-on-findings is now true; future PRs that introduce critical/high findings will block merge.