Under the hood: Security architecture of GitHub Agentic Workflows — Blankdot