fix(security): address Copilot/coderabbit review on PR #140

- src/ledgerbase/__init__.py: read LEDGERBASE_ENV in addition to the
  Flask 3.x-deprecated FLASK_ENV when selecting prod vs dev, and
  document the choice. Avoids silently treating a misconfigured
  production deploy as dev when only one of the variables is set.
- src/ledgerbase/config.py: drop the dead ProductionConfig.__init__
  (Flask's from_object does not instantiate). Move the check into a
  module-level validate_production_env() and call it from get_config()
  so the fail-fast actually runs.
- All workflows: re-pin step-security/harden-runner from v2.10.1
  (which was a downgrade from the prior v2.12 reference) to v2.12.0
  (SHA 0634a2670c59f64b4a01f0f96f84700a4088b9f0).
- .github/workflows/cifuzzy.yml: correct the inline note so it
  reflects the actual egress-policy (audit) and points at the
  follow-up to tighten to block.
- SECURITY-FINDINGS.md: update SHA table to v2.12.0; add `bash`
  language tag on the fenced grep example (markdownlint MD040).

Skipped — pre-existing issues on `main`, not regressions from this PR
and outside the audit scope:
- .github/workflows/security-bandit.yml step mixing `run:` and `uses:`.
- .github/workflows/templates/test-matrix.yml coverage.xml not passed
  between jobs.
- Code Quality format failures in 7 unrelated repo-root files
  (docs/source/conf.py, load_env.py, noxfile.py, scripts/*.py,
  vulture_whitelist.py) — already failing on `main` before this PR.
- FIPS Compliance / CodeQL / Python Compat / submit-pypi job-level
  failures: workflows expect uv.lock which the repo doesn't have
  (only poetry.lock). Pre-existing infrastructure mismatch.

Author: claude

.github/workflows/auto-merge.yml

@@ -32,7 +32,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Harden the runner (Audit all outbound calls)
-              uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+              uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
               with:
                   egress-policy: audit
 

.github/workflows/cifuzzy.yml

@@ -37,7 +37,7 @@ jobs:
       security-events: write
     steps:
       - name: Harden runner (audit outbound)
-        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
@@ -47,8 +47,11 @@ jobs:
       - name: Build Fuzzers
         id: build
         # NOTE: google/oss-fuzz publishes CIFuzz actions only on the `master`
-        # branch; no immutable SHA is available upstream. See SECURITY-FINDINGS.md
-        # GHA-006 for the mitigation plan (run inside a hardened, egress-blocked job).
+        # branch; no immutable SHA is available upstream. The job runs with
+        # step-security/harden-runner in `egress-policy: audit` so any
+        # unexpected outbound calls show up in the run summary. See
+        # SECURITY-FINDINGS.md GHA-006 — tighten to `block` with an
+        # allow-list once the audit run is reviewed.
         uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
         with:
           oss-fuzz-project-name: "ledgerbase"

.github/workflows/codeql.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Harden the runner
-        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/dependency-review.yml

@@ -30,7 +30,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Harden the runner (Audit all outbound calls)
-              uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+              uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
               with:
                   egress-policy: audit
 

.github/workflows/deploy.yml

@@ -36,7 +36,7 @@ jobs:
 
         steps:
             - name: Harden the runner (Audit all outbound calls)
-              uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+              uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
               with:
                   egress-policy: audit
 

.github/workflows/dev-checks.yml

@@ -41,7 +41,7 @@ jobs:
             versions: ${{ steps.load.outputs.versions }}
         steps:
             - name: Harden the runner (Audit all outbound calls)
-              uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+              uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
               with:
                   egress-policy: audit
 

.github/workflows/fips-compatibility.yml

@@ -48,7 +48,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/gh-pages.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/license.yml

@@ -47,7 +47,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 
@@ -77,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit
 

.github/workflows/prepare-poetry.yml

@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
+        uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
         with:
           egress-policy: audit