chore(contributor-check): bump AGT pin to 359a6b8 - #26

The AGT pin was 410fb2cc (2026-06-09). Every agentrust-io repo has been
running contributor detection logic about two months stale.

The bug this fixes

At the old pin:

RISK_ORDER = {"LOW": 1, "MEDIUM": 2, "HIGH": 3, "UNKNOWN": 0}

UNKNOWN sorted below LOW, so it never met the MEDIUM comment
threshold. A check that errored, or got rate-limited by the GitHub API, was
silently dropped and effectively read as a clean result. Current:

RISK_ORDER = {"LOW": 1, "MEDIUM": 2, "UNKNOWN": 3, "HIGH": 4}

An undetermined result now outranks LOW and MEDIUM and gets surfaced for a
human to look at. Fail-closed (upstream microsoft/agent-governance-toolkit#2950).

Also picked up

Roughly 360 lines of contributor_check.py hardening: org-backed and
prior-interaction credibility tiers, the maintainer allowlist that can only
soften a HIGH auto-flag to MEDIUM and can never grant LOW, and guards against
star-bought repos and two-account merge rings.

Verified no breaking change

• contributor_check_action.py CLI arguments are unchanged between the pins.
• .github/actions/contributor-check/ upstream is byte-identical between the
  two pins.
• brand_comment.py matches the footer by line prefix, not exact text, so
  AgenTrust branding still applies.

Propagation, and a separate problem

7 of the 8 consuming repos check this repo out with ref: main, so they pick
this up as soon as it merges. awesome-ai-governance is pinned to 0b440ff
and will not.

That mutable ref: main is itself worth fixing. These are
pull_request_target workflows holding issues: write and
pull-requests: write, and this action's own template comment says the ref
"must not be a mutable ref". Raising separately rather than bundling it, since
pinning 8 repos to SHAs is a maintenance-model decision, not a one-line change.