fix(ci): triage semgrep findings, make the gate blocking (WP-30 #6)

Local semgrep run found 25 findings (not the WP's remembered 27 — already-stale
by the time this ran): dependabot cooldown, npm min-release-age, every GitHub
Action pinned to a full commit SHA (dependabot's existing github-actions
ecosystem entry keeps these current), and 2 detect-non-literal-regexp findings
in e2e/create-ssp.mjs suppressed as false positives (non-attacker-controlled
input: a test's own captured version number, a local generator's CLI arg).
`semgrep scan` now runs with `--error`, a real blocking gate instead of
report-only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/create-ssp.mjs

@@ -131,7 +131,9 @@ function stripContexts(names, args) {
 function pruneDependencyCruiser(name, args) {
   const file = '.dependency-cruiser.js';
   const content = readFile(file);
-  const re = new RegExp(`^\\s*${name}:\\s*(?:\\[[^\\]]*\\]|null),.*\\n`, 'm');
+  // name is this local generator's own CLI arg (the operator's own context name), never
+  // external/attacker input.
+  const re = new RegExp(`^\\s*${name}:\\s*(?:\\[[^\\]]*\\]|null),.*\\n`, 'm'); // nosemgrep
   const next = content.replace(re, '');
   if (next === content) {
     console.log(`  (no CONTEXT_ALLOWED entry for '${name}' in ${file} — already gone?)`);
@@ -143,7 +145,9 @@ function pruneDependencyCruiser(name, args) {
 function pruneTsconfig(name, args) {
   const file = 'tsconfig.json';
   const content = readFile(file);
-  const re = new RegExp(`^\\s*"@${name}/\\*":\\s*\\["src/app/${name}/\\*"\\],\\n`, 'm');
+  // name is this local generator's own CLI arg (the operator's own context name), never
+  // external/attacker input.
+  const re = new RegExp(`^\\s*"@${name}/\\*":\\s*\\["src/app/${name}/\\*"\\],\\n`, 'm'); // nosemgrep
   const next = content.replace(re, '');
   if (next === content) {
     console.log(`  (no @${name}/* alias in ${file} — already gone?)`);