feat(ci): pin Semgrep + rule packs (semgrep = "latest" + --config auto lets registry changes break CI)

## Problem

`mise.toml` pins `semgrep = "latest"` (line 27) and `security:sast` uses `--config auto` (line 140), which fetches rules **live from the semgrep registry** at scan time. This means CI's SAST behavior can change with no code change on our side — a newly published or modified rule can turn `main` red unexpectedly.

This is not hypothetical: it is the **root cause of #532** — the `uv-missing-dependency-cooldown` rule (added in semgrep 0.9.17) was picked up automatically and failed the suite, with no change to our code.

## Proposed

- Pin the semgrep engine to an exact version (not `latest`) in `mise.toml`.
- Pin / vendor the rule packs (or at least the `--config` sources) so rule changes are adopted deliberately, not silently.
- Consider a periodic bump (like `upgrade-main.yml`) so updates are reviewed in a PR rather than surprising a scheduled run.

## Acceptance criteria

- SAST rule set is version-controlled / pinned; a registry-side rule change cannot change CI outcome without a PR.

## Context

Maintainer-requested follow-up from #532. See also related CI-hardening issues #329, #328.

Empieza por las líneas 27 y 140 de mise.toml y, después, inspecciona el flujo de trabajo de CI y upgrade-main.yml referenciados en el issue. Revisa #532 y los issues relacionados con CI-hardening para entender el fallo y los patrones de actualización existentes. Se considera terminado cuando los cambios de reglas de Semgrep del lado del registry no puedan alterar los resultados de SAST sin un PR revisado.

Escrito por el modelo de indexación a partir del texto del issue.