build: Fix Semgrep installation in Alpine images

[julio-rocketchat]

Summary

• Install gcc, musl-dev, and python3-dev temporarily while building pinned Semgrep dependencies, then remove them.
• Copy scripts into the build stage because npm run build compiles tsconfig.scripts.json as well as application code.

Verification

• Built the complete Linux ARM64 image from a Git-only archive, excluding local environment files and untracked content.
• Network-disabled runtime smoke test passed: Semgrep 1.154.0, Trufflehog 3.93.7, OSV-Scanner 2.3.8.
• Verified non-root runtime, gcc absent, and no /app/.env.
• Node 22: build, typecheck, lint, configuration validation, and all 619 tests passed.
• Reviewed build-stage boundaries, runtime permissions, and credential exposure. Gitleaks staged-patch scan passed.

CI now uses the committed lockfile via npm ci; all GitHub checks pass.

[julio-rocketchat]

CI follow-up: the shared install failure was reproduced in an isolated Node 22 container. With maintainer approval, this branch now uses npm ci instead of deleting the lockfile and resolving a fresh dependency graph. This is the only CI change; GitHub checks are rerunning.