feat(cicd): enforce cicd sast & package check

[aeppling]

Summary

• semgrep for sast check by yml rules
• dependabot for package detection
• update CICD doc
• clippy -D unsafe_code hard fail

Test plan

• YAML syntax validated (python3 yaml.safe_load) for all 3 files
• Semgrep installed locally and ran against full codebase (10 rules, 0 parse errors)
• Verified 8 ERROR findings on pre-existing code (baseline will filter in CI)
• Verified 15 WARNING findings on pre-existing code (all legitimate)
• Confirmed no false positives on new code (no .semgrep.yml or .github/ files flagged)
• Push branch and verify semgrep job appears in GitHub Actions
• Open PR to develop and confirm SEMGREP_BASELINE_REF filters pre-existing findings
• Verify Dependabot starts creating PRs after merge (weekly schedule)

[pszymkowiak]

[w] wshm · Automated triage by AI

📊 Automated PR Analysis

✨ Type	feature
🟡 Risk	medium

Summary

Adds SAST (Static Application Security Testing) via Semgrep with custom rules tailored to the RTK project, configures Dependabot for weekly Cargo and GitHub Actions dependency updates, hardens the CI clippy step to hard-fail on unsafe code, and updates the CICD documentation to reflect the new pipeline stages.

Review Checklist

• Tests present
• Breaking change
• Docs updated

---

Analyzed automatically by wshm · This is an automated analysis, not a human review.

[FlorianBruniaux]

ok