ci(security): pin the llm-registre reusable workflow to a commit

It runs in our context with a tracker-write token; @main let upstream change that unreviewed.

Author: jfarcand

.github/workflows/feature-phase-review.yml

@@ -14,7 +14,13 @@ permissions:
 
 jobs:
   review:
-    uses: dravr-ai/llm-registre/.github/workflows/feature-phase-review-reusable.yml@main
+    # Pinned to a commit, not @main: this reusable workflow runs in our context
+    # with a token that can write issues on the private tracker, so upstream
+    # must not be able to change what executes here without review. It is the
+    # same commit the .registre submodule pins, so the two agree. Upstream cuts
+    # no tags, so Dependabot will not bump this — move it by hand alongside the
+    # submodule, after reading the diff of the called workflow.
+    uses: dravr-ai/llm-registre/.github/workflows/feature-phase-review-reusable.yml@7d9c97acb1b6f484a931ce6e838db836fdb0fd0e
     with:
       tracker: jfarcand/mirroir-carnet
       repo_label: iphone-mirroir-mcp