chore(deps): bump hackmyagent 0.23.6 -> 0.23.11 (#223)

Propagates the HMA 0.23.11 scanner fixes into `opena2a review`/`scan`:
- GIT-003 (.env Not Ignored) content-aware severity (#242): a secret-less
  .env is now HIGH not CRITICAL, so `opena2a review` on a clean repo with a
  config-only .env scores 90/100 'Good overall' instead of printing a
  contradictory 'Not safe to ship' beside a good composite.
- MEM-006 local render-array push FP fix (#244).

Verified: opena2a build green, corpus scan<->secure parity 12/12 (0 failed),
and `opena2a review` on a secret-less .env now renders 90/100 'Good overall'.
Exact pin per the CLI-consolidation supply-chain rule.

Author: thebenignhacker

package-lock.json

@@ -29,7 +29,7 @@
     "@opena2a/telemetry": "0.3.0",
     "ai-trust": "^0.2.23",
     "commander": "^13.1.0",
-    "hackmyagent": "0.23.6",
+    "hackmyagent": "0.23.11",
     "secretless-ai": "^0.14.1"
   },
   "optionalDependencies": {