feat(ci): pin Semgrep + rule packs (semgrep = "latest" + --config auto lets registry changes break CI)

## Problem

`mise.toml` pins `semgrep = "latest"` (line 27) and `security:sast` uses `--config auto` (line 140), which fetches rules **live from the semgrep registry** at scan time. This means CI's SAST behavior can change with no code change on our side — a newly published or modified rule can turn `main` red unexpectedly.

This is not hypothetical: it is the **root cause of #532** — the `uv-missing-dependency-cooldown` rule (added in semgrep 0.9.17) was picked up automatically and failed the suite, with no change to our code.

## Proposed

- Pin the semgrep engine to an exact version (not `latest`) in `mise.toml`.
- Pin / vendor the rule packs (or at least the `--config` sources) so rule changes are adopted deliberately, not silently.
- Consider a periodic bump (like `upgrade-main.yml`) so updates are reviewed in a PR rather than surprising a scheduled run.

## Acceptance criteria

- SAST rule set is version-controlled / pinned; a registry-side rule change cannot change CI outcome without a PR.

## Context

Maintainer-requested follow-up from #532. See also related CI-hardening issues #329, #328.

まず mise.toml の 27 行目と 140 行目から始め、issue で参照されている CI workflow と upgrade-main.yml を確認します。失敗の内容と既存の更新パターンを理解するために、#532 と関連する CI-hardening issues を確認します。registry 側の Semgrep ルール変更によって、レビュー済みの PR なしに SAST 結果を変更できなければ完了です。

索引モデルが issue の本文から書いたものです。