feat(ci): pin Semgrep + rule packs (semgrep = "latest" + --config auto lets registry changes break CI)

## Problem

`mise.toml` pins `semgrep = "latest"` (line 27) and `security:sast` uses `--config auto` (line 140), which fetches rules **live from the semgrep registry** at scan time. This means CI's SAST behavior can change with no code change on our side — a newly published or modified rule can turn `main` red unexpectedly.

This is not hypothetical: it is the **root cause of #532** — the `uv-missing-dependency-cooldown` rule (added in semgrep 0.9.17) was picked up automatically and failed the suite, with no change to our code.

## Proposed

- Pin the semgrep engine to an exact version (not `latest`) in `mise.toml`.
- Pin / vendor the rule packs (or at least the `--config` sources) so rule changes are adopted deliberately, not silently.
- Consider a periodic bump (like `upgrade-main.yml`) so updates are reviewed in a PR rather than surprising a scheduled run.

## Acceptance criteria

- SAST rule set is version-controlled / pinned; a registry-side rule change cannot change CI outcome without a PR.

## Context

Maintainer-requested follow-up from #532. See also related CI-hardening issues #329, #328.

Beginne mit den Zeilen 27 und 140 in mise.toml und prüfe anschließend den im Issue referenzierten CI-Workflow und upgrade-main.yml. Sieh dir #532 und die zugehörigen CI-Hardening-Issues an, um den Fehler und die bestehenden Update-Muster zu verstehen. Als erledigt gilt die Aufgabe, wenn Änderungen an Semgrep-Regeln auf der Registry-Seite die SAST-Ergebnisse nicht ohne einen geprüften PR verändern können.

Vom Indexierungsmodell aus dem Issue-Text verfasst.