ci(scan): adopt static pin check for auto-exec MCP launchers (annotate-only) + waivers file

Re-pin scan-plugins to the community#2361 head: deterministic detection
of floating npx/bunx/uvx/pipx MCP-server launcher specs (registry-resolved
at session start, not fixed by the pinned source SHA). This surface stays
annotate-only — fail-on-unpinned-autoexec is deliberately not set. Ships
.github/policy/launch-shape-waivers.txt with the two existing
maintainer-adjudicated grants (@azure/ scope; ui5-modernization).

Re-pin to the merge SHA once community#2361 lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/policy/launch-shape-waivers.txt

@@ -0,0 +1,17 @@
+# launch-shape-waivers.txt — package-grained exceptions to the scan-plugins
+# static pin check (floating auto-exec npx/uvx/bunx/pipx launcher specs in a
+# plugin's .mcp.json). See the scan-plugins action README for the mechanism.
+#
+# Line format: `<entry-name> <package-prefix> [<package-prefix>…]  # rationale`
+#   - a prefix ending in "/" waives any package whose name STARTS with it (a
+#     scope, e.g. `@vendor/`); any other prefix must EQUAL the package name.
+#   - EVERY floating spec declared by the entry must match a granted prefix or
+#     the finding stands — a later-added third-party floating launcher on a
+#     waived entry is still flagged.
+#   - a bare entry name with no prefixes never waives.
+#   - waivers are maintainer-adjudicated only; the bar is that the floating
+#     package is the plugin vendor's OWN published package (same trust domain
+#     as the pinned source repo), evidenced in the rationale.
+
+azure @azure/  # first-party scope: the @azure npm scope is published by the same vendor as the entry's pinned source repo (npm repository field -> github.com/microsoft/mcp). Granted 2026-08-04.
+ui5-modernization chrome-devtools-mcp  # maintainer-granted exception, 2026-08-09 (package is a widely-used vendor-published devtools bridge; not the plugin vendor's own scope). Re-review by 2026-11-09.

.github/workflows/scan-plugins.yml

@@ -194,9 +194,10 @@ jobs:
         # The verdict (cached + fresh) is what gates the job, not the action's
         # exit code, and the revert workflow needs the artifact even on failure.
         continue-on-error: true
-        # Pinned to claude-plugins-community#34 (WIF input support).
-        # TODO: re-pin to a main-branch SHA once #34 merges.
-        uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@426e469f322952061102b286b378c0c9733a0934
+        # Pinned to claude-plugins-community#2361 (static pin check for
+        # auto-exec MCP launchers — detection always on, warn-only here).
+        # TODO: re-pin to the main-branch merge SHA once #2361 merges.
+        uses: anthropics/claude-plugins-community/.github/actions/scan-plugins@3f3ff3f254ac412c5ff89cb00ed8f1219bba36a0
         with:
           # Anthropic auth via Workload Identity Federation — the action
           # mints a GitHub OIDC token (id-token: write above) and the claude
@@ -208,6 +209,10 @@ jobs:
           marketplace-path: .scan-cache/scan-targets.json
           policy-prompt: .github/policy/prompt.md
           fail-on-findings: "true"
+          # Static pin check: detection + annotation only on this surface
+          # (fail-on-unpinned-autoexec deliberately not set). Adjudicated
+          # exceptions live in the repo-local waivers file.
+          launch-shape-waivers: .github/policy/launch-shape-waivers.txt
           claude-cli-version: latest
 
       # Merge fresh verdicts into the cache and assemble this run's full