feat(ci): pin Semgrep + rule packs (semgrep = "latest" + --config auto lets registry changes break CI)

## Problem

`mise.toml` pins `semgrep = "latest"` (line 27) and `security:sast` uses `--config auto` (line 140), which fetches rules **live from the semgrep registry** at scan time. This means CI's SAST behavior can change with no code change on our side — a newly published or modified rule can turn `main` red unexpectedly.

This is not hypothetical: it is the **root cause of #532** — the `uv-missing-dependency-cooldown` rule (added in semgrep 0.9.17) was picked up automatically and failed the suite, with no change to our code.

## Proposed

- Pin the semgrep engine to an exact version (not `latest`) in `mise.toml`.
- Pin / vendor the rule packs (or at least the `--config` sources) so rule changes are adopted deliberately, not silently.
- Consider a periodic bump (like `upgrade-main.yml`) so updates are reviewed in a PR rather than surprising a scheduled run.

## Acceptance criteria

- SAST rule set is version-controlled / pinned; a registry-side rule change cannot change CI outcome without a PR.

## Context

Maintainer-requested follow-up from #532. See also related CI-hardening issues #329, #328.

Start with mise.toml lines 27 and 140, then inspect the CI workflow and upgrade-main.yml referenced in the issue. Review #532 and the related CI-hardening issues to understand the failure and existing update patterns. Done means registry-side Semgrep rule changes cannot alter SAST results without a reviewed PR.

Written by the indexing model from the issue text.