Explain stubsabot cache poisoning risk

Author: AlexWaygood

.github/workflows/stubsabot.yml

@@ -28,7 +28,9 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           version-file: "requirements-tests.txt"
-          # Test jobs can populate this cache; stubsabot has push credentials.
+          # A compromised dependency in a test job on main could poison the shared
+          # uv cache. Restoring it here could execute attacker-controlled code
+          # with access to stubsabot's SSH key and GitHub token.
           enable-cache: false
       - name: Git config
         run: |