fix(ci): pin local Semgrep to semgrep.yml image tag

[FabioLeitao]

Summary

• Local --enforced Semgrep now uses uvx semgrep@X.Y.Z where X.Y.Z is parsed from the semgrep/semgrep: image tag in .github/workflows/semgrep.yml (single pin; no duplicated version in the scripts).
• Fail-closed if that tag cannot be read — never falls back to floating uvx semgrep.
• Zizmor stays unpinned CLI (uvx zizmor): CI runs zizmor-action (different artifact). Documented in scripts + QUALITY docs.
• Tests in tests/test_scripts.py assert the pin is derived from the workflow, not hardcoded.

Closes #1793.

Local --enforced note (not a regression of this fix)

On this Linux primary workstation, ./scripts/check-all.sh --enforced can still fail after a successful pin (Semgrep pin: 1.117.0 was printed and uvx installed that package). Semgrep 1.117.0 via uvx uses the host Python (here 3.14); protobuf/OpenTelemetry in that wheel crash with TypeError: Metaclasses with custom tp_new are not supported. CI Semgrep runs inside the pinned container, not host uvx. That host-runtime mismatch is known and out of scope for #1793.

Pre-push gate here: ./scripts/check-all.sh (without --enforced) — pre-commit, pytest, Bandit, Zizmor — OK.

Test plan

• uv run pytest tests/test_scripts.py -q
• ./scripts/check-all.sh (no --enforced)
• CI Semgrep job on this PR (container pin)
• Optional: --enforced on a host whose Python can import Semgrep 1.117.0, or accept container-only parity for the engine runtime

[greptile-apps]

FabioLeitao has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.

So far, Strix has reviewed 36 pull requests, surfaced 5 security issues (1 critical/high) and blocked 1 risky merge across this workspace.