ci: add semgrep SAST scanning to CI and pre-commit (#14964)

* ci: add semgrep SAST scanning to CI and pre-commit

Add semgrep static analysis to the security workflow and pre-commit
hooks. Uses `--config auto` for comprehensive coverage across Python,
Dockerfile, and GitHub Actions. The intentional `USER root` in the
Dockerfile (required for bind mount compatibility) is excluded via
`--exclude-rule`.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ci: pin semgrep container image to digest for zizmor

Pin semgrep/semgrep to sha256 digest (v1.151.0) to satisfy
zizmor's unpinned-images audit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ci: add zizmor pre-commit hook for Actions security audit

Matches the existing actionlint pattern — gracefully skips if zizmor
is not installed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/security.yml

@@ -10,6 +10,22 @@ permissions:
   contents: read
 
 jobs:
+  semgrep:
+    name: Semgrep SAST
+    runs-on: ubuntu-22.04
+    container:
+      image: semgrep/semgrep@sha256:d3d1be3a3770514d16a6a57b9761575d7536d70f45a5220274f4ec7d55c442b9  # v1.151.0
+    steps:
+      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98  # v5.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run semgrep
+        run: >
+          semgrep --config auto
+          --exclude-rule dockerfile.security.last-user-is-root.last-user-is-root
+          --error --quiet .
+
   pip-audit:
     name: Python dependency audit
     runs-on: ubuntu-22.04