ci: switch security-fix to gpt-5.6-terra; pin ai-review to 1.32.20260826

[absorbb]

Summary

Follow-up to #1482 (merged before this could be folded in).

• security-fix.yml: gpt-5.3-codex → gpt-5.6-terra (effort: high unchanged), matching the ai-review model switch released as github-workflows 1.32.20260826 (feat(ai-review): switch to gpt-5.6-terra; add moving current tag github-workflows#10). Terra is in the pinned codex CLI 0.149.0 preset list; 5.3-codex no longer is.
• ai-review.yml: bump the pinned jitsucom/github-workflows release from 1.30.20260821 to 1.32.20260826. (An earlier revision of this PR used a floating current tag; that approach is rolled back in fix(release): drop the moving current tag; consumers pin release tags github-workflows#11 and the tag is removed.)

Test plan

• YAML parses; diff reviewed
• The AI Review check on this PR runs on Terra (job summary shows Model: gpt-5.6-terra)
• Next security-fix run (Monday 08:00 UTC, or workflow_dispatch with dry_run: true) completes the Codex step on Terra

🤖 Generated with Claude Code

[jitsu-code-review]

Reviewed the workflow changes in this PR. Model switch to gpt-5.6-terra looks consistent with the pinned CLI setup. I left one inline security concern about using a moving workflow ref.

[jitsu-code-review]

Reviewed the workflow reference and scheduled security-fix model update. The reusable workflow remains pinned to release 1.32.20260826, and gpt-5.6-terra is the documented replacement for the deprecated gpt-5.3-codex. No actionable issues found.

[jitsu-code-review]

Reviewed the two workflow changes. The reusable-workflow tag resolves successfully and its review step uses the same pinned Codex CLI with gpt-5.6-terra; both edited workflow files parse as YAML.

Findings: no new actionable issues.