chore(ci): flip Remy to PR against master

[rrama]

Description

Adds open-source-agentic-fix-base-branch: master to .circleci/config.yml's prodsec/security_scans step (prodsec-orb v1.2.32), so the agentic-fix bot targets master instead of whatever feature branch it happens to scan. Same fix as snyk/snyk-ls#1432, opened here as a test to see if it would actually cause a fix PR to land against master.

Result: inconclusive, not a failure. Checked the CircleCI security-scans job for this PR's commit (pipeline #2165, job 4261). The Open Source scan step ran, but the Agentic fix for blocking Open Source vulnerabilities step logged:

[agentic fix] Skipped: the Open Source scan found no vulnerabilities at or above high.

There's currently no High-or-above OSS vulnerability on this branch, so the agentic-fix path never engaged — the new open-source-agentic-fix-base-branch parameter was never exercised, in either direction. This isn't evidence the config change doesn't work; there was simply nothing for it to fix. (The "Configured mode=auto ... Changing to mode=gate" log line is a separate, unrelated mechanism — it governs whether the scan itself blocks the build on this non-release branch, not whether the agentic-fix step runs.)

To actually validate this, we'd need either a real High+ vulnerability present when the job runs, or to wait for the next scan that finds one on a branch with this config.

Checklist

• Read and understood the Code of Conduct and Contributing Guidelines.
• Tests added and all succeed
• Linted
• README.md updated, if user-facing

Screenshots / GIFs

Visuals that may help the reviewer. Please add screenshots for any UI change. GIFs are most welcome!

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

Code Coverage

Total Project Coverage	48.67%	✅