Re-pin scan-plugins to the community#2361 head: deterministic detection
of floating npx/bunx/uvx/pipx MCP-server launcher specs (registry-resolved
at session start, not fixed by the pinned source SHA). This surface stays
annotate-only — fail-on-unpinned-autoexec is deliberately not set. Ships
.github/policy/launch-shape-waivers.txt with the two existing
maintainer-adjudicated grants (@azure/ scope; ui5-modernization).
Re-pin to the merge SHA once community#2361 lands.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
