Merge branch 'main' into copilot/pin-awf-version-with-image-tag

Author: Mossaka

.github/workflows/ai-moderator.lock.yml

@@ -9,7 +9,7 @@ permissions:
   pull-requests: read
 tracker-id: blog-auditor-weekly
 engine: claude
-strict: false
+strict: true
 network:
   allowed:
     - defaults

.github/workflows/archie.lock.yml

@@ -15,7 +15,7 @@ permissions:
 engine:
   id: codex
   model: gpt-5-mini
-strict: false  # Required: codex engine doesn't support network firewall
+strict: true
 safe-outputs:
   push-to-pull-request-branch:
     commit-title-suffix: " [skip-ci]"