fix(ci): triage semgrep findings, make the gate blocking (WP-30 #6)

Local semgrep run found 25 findings (not the WP's remembered 27 — already-stale
by the time this ran): dependabot cooldown, npm min-release-age, every GitHub
Action pinned to a full commit SHA (dependabot's existing github-actions
ecosystem entry keeps these current), and 2 detect-non-literal-regexp findings
in e2e/create-ssp.mjs suppressed as false positives (non-attacker-controlled
input: a test's own captured version number, a local generator's CLI arg).
`semgrep scan` now runs with `--error`, a real blocking gate instead of
report-only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.npmrc

@@ -1,3 +1,7 @@
 # @storybook/angular's peer range lags Angular 22; the builder works fine at runtime.
 # ponytail: one flag beats pinning the whole app back to Angular 21.
 legacy-peer-deps=true
+
+# WP-30: wait 7 days before resolving newly-published package versions (semgrep
+# npm-missing-minimum-release-age) — guards against a freshly-published malicious/unstable release.
+min-release-age=7