ci: pin semgrep to 1.175.0 and screen its install

[hironow]

Owner decision Q44(a), revised to 1.175.0 after the version check. One ci:
commit.

Why

pipx install semgrep took whatever was newest at run time. semgrep gates
merges, so a release could turn CI red on a commit that changed nothing — a new
or widened rule needs no commit behind it to start failing.

The job also gains the Takumi Guard step every other install-bearing job has,
placed before uv tool install so the install resolves through the screened
index rather than PyPI. This was the last unscreened install in the repo.

Why 1.175.0 and not the newest

1.176.0 would have been a version the project's own supply-chain rules reject,
on two independent counts:

	1.176.0	1.175.0
On the screened index	no — proxy carries up to 1.175.0	yes
Older than the seven-day exclude-newer window	no — published 2026-09-01	yes — 2026-08-26

With Takumi Guard now in this job, pinning 1.176.0 would not merely have been
inconsistent — it would have failed outright. The step comment records the rule
for whoever raises it next: pick a version the proxy carries and that is older
than the window.

CI evidence

Takumi Guard configures the job's index:

Route installs through Takumi Guard
  registry-url: https://pypi.flatt.tech
  set-index-url: true

and the install resolves through it:

Run uv tool install semgrep==1.175.0
Resolved 66 packages in 8.33s
Installed 66 packages in 30ms
 + semgrep==1.175.0

Local verification

Run against semgrep 1.175.0 — the machine's own semgrep is 1.162.0 and was
left untouched.

Check	Result
just semgrep-test	3/3 rules pass
just semgrep	0 findings, 3 rules, 21 targets
just ci	pass
prek check-yaml	pass
Actions SHA-pinned	11/11

Worth noting how that verification resolved: with no index or cutoff
override, through a uv configured for the screened index and the seven-day
window. Getting 1.175.0 that way is itself the proof it satisfies both rules —
the same command could not produce 1.176.0.

Job names unchanged; the protect ruleset matches its eleven required checks by
name.

Docs

docs/release.md: CI pins semgrep to 1.175.0 and installs it through the
screened index; Dependabot does not track it, so raising the version is a
deliberate edit — pick one the proxy carries and that is older than the
seven-day window. docs/handover.md untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LXPmm8VuMHBjo4Q6k7tRtq