chore(ci): reduce Semgrep findings (Dependabot cooldown + pin actions)

[otavio]

What

First tranche of the Semgrep full-scan cleanup on master — the two safe,
mechanical, behavior-preserving buckets. Takes the full-scan findings from
127 → 54 (locally verified with the same semgrep/semgrep:1.154.0 image
and p/golang p/dockerfile p/ci configs).

1. Dependabot cooldown (dependabot-missing-cooldown, 12 findings)

Added cooldown: { default-days: 7 } to all 12 package-ecosystem entries in
.github/dependabot.yml. A freshly published (possibly compromised) version now
soaks for 7 days before Dependabot proposes it — the classic window for a
supply-chain attack to be caught and yanked. Pure scheduling policy; no runtime
effect.

2. Pin GitHub Actions to commit SHAs (github-actions-mutable-action-tag, 61 findings)

Pinned all 61 remaining mutable-tag action references (e.g. @v7) to the commit
SHA the tag currently resolves to, each with a # <tag> comment so Dependabot
keeps them updated. A mutable tag can be force-moved to malicious code after
review; a SHA can't.

• No version bumps — every action was already on its latest major and
  latest patch; I verified all 24 distinct actions are pinned to the SHA of
  their current release. This is a pure pin, not an upgrade.
• Reused the SHAs the repo already pins for the same action versions; resolved
  the remaining 9 via the GitHub API.

Verification

• Re-ran the Semgrep scan after each change: both buckets go to 0 with no
  new findings introduced.
• All workflow YAML re-parsed clean.

Scope / not included

The remaining 54 findings need code judgment rather than a mechanical sweep and
are intentionally left for follow-ups: Dockerfile USER hardening (12, ERROR,
runtime-risky), avoid-ssh-insecure-ignore-host-key (31, likely intentional for
an SSH gateway/tests), and a handful of one-off code-level rules (math/rand,
websocket origin, TLS, deserialization, bind-all). The full-scan check will stay
red until those are triaged.

[github-actions]

Claude finished @otavio's task in 4m 7s —— View job

---

Code Review Complete

Reviewed 14 files across code quality, security, testing, language patterns, and architecture — no new issues found. The code looks good as-is.

For a mechanical pin-and-cooldown PR the risk surface is narrow, so I verified the things that actually matter here:

• SHA ↔ tag correctness — resolved all 21 distinct pinned actions against the GitHub API (repos/<action>/commits/<tag>). Every SHA matches the tag in its # vN comment exactly. No accidental version drift, no wrong commit. ✅
• Cross-file consistency — every occurrence of a given action+tag maps to the same SHA across all workflows (including the already-pinned files like codeql.yml/docker-publish.yml), confirming the "reused existing pins" claim. ✅
• YAML validity — dependabot.yml cooldown blocks are correctly nested (sibling of schedule at 2-space indent, default-days: 7 at 4) across all 12 ecosystem entries; workflow edits are single-line uses: replacements. ✅
• Behavior preservation — pure pins (no major/patch bumps) plus a scheduling-only cooldown policy; no runtime effect. ✅

The scoping note in the PR body is accurate — the remaining Semgrep findings (Dockerfile USER, insecure-ignore-host-key, and the code-level one-offs) genuinely need judgment and are reasonable follow-ups.

To request another review round, comment /review.