feat(ci): add Semgrep security scanning and dependency health checks (#90)

[troylar]

Summary

• Replace removed Snyk with Semgrep for SAST security scanning in CI
• Add pip-audit for dependency vulnerability checking in CI
• Add Step 3b (Dependency Health) to /submit-pr skill for pre-PR security validation
• Version-control all .claude/commands/ and .claude/rules/ files

Changes

CI (.github/workflows/ci.yml)

• New security job with Semgrep scan (p/python, p/security-audit, p/owasp-top-ten) and pip-audit
• Security job runs in parallel with quality/test but is NOT in all-checks-pass gate (informational in CI, blocking in skill)

Skills (.claude/commands/submit-pr.md)

• New Step 3b: Dependency Health (runs in parallel with Steps 4/5):
  • pip-audit vulnerability audit (blocking)
  • Outdated dependency check via pip list --outdated (non-blocking warning)
  • New dependency PyPI review when pyproject.toml changes (non-blocking)
  • Semgrep security scan (blocking)
• Enhanced Agent E security scan with OWASP ASVS Level 2 checklist
• Updated validation report with Dependency Health section
• Added Blocking vs Non-Blocking classification to guidelines

Version-controlled Claude Config

• 13 command files (cleanup, code-review, commit, deploy, dev-help, ideate, new-issue, next, pr-check, start-work, triage, write-docs)
• 6 rule files (commit-format, no-code-without-issue, output-formatting, product-vision, security-patterns, test-requirements)

Issue References

Closes #90

Test Plan

• CI passes with new Semgrep and pip-audit jobs
• Semgrep doesn't flag false positives on existing codebase
• pip-audit runs successfully (continue-on-error for known issues)
• /submit-pr skill renders updated report format
• All existing tests pass: invoke test-unit

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

📊 Code Quality Report

Linting Issues

All checks passed!

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.92%. Comparing base (0b7fb79) to head (0c51421).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #91   +/-   ##
=======================================
  Coverage   84.92%   84.92%           
=======================================
  Files          76       76           
  Lines        6569     6569           
=======================================
  Hits         5579     5579           
  Misses        990      990           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.