fix(oidc): roll trust to reviewed central workflow source

[seonghobae]

Scope

Roll Noema's exact workflow-source allowlist from central .github commit f16280a0aa215563d29200c5d0bab75c48af614a to current protected central commit eb0ee5c68c9e807644a920c1a5fb4caa1cf2fe97 so OIDC exchange does not reject the current trusted noema-review workflow source as stale.

Exact dependency review

The central source is read-only from this writer. Comparing f16280a... to eb0ee5c... shows two commits touching Strix/Python-security/hourly-review/docs/requirements paths only; neither .github/workflows/noema-review.yml nor scripts/ci/noema_review_gate.py changed. The trusted noema-review.yml blob is exactly 59b25e343444d0b97fc1c7ba33cb15543dd70102 at both commits.

This PR changes only wrangler.toml's ALLOWED_WORKFLOW_SHA; it does not weaken exact SHA matching or accept multiple workflow sources.

Evidence boundary

Keep Draft until fresh exact-head application CI, reviewer-ci, and eligible central Security Scan are terminal-success and central protected main/source identity is revalidated immediately before integration. If central moves again, re-review the intervening delta rather than blindly chasing the ref.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f1d31b52-6e73-4d5b-8316-06bdb560f805

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}