chore(security): scope scanner configs to production code

[rorymcentee]

Adds .semgrepignore — scope Semgrep SAST to production code

Why

A user-defined .semgrepignore REPLACES Semgrep's built-in default ignore
list. Without this file (or without carrying the defaults forward), paths like
node_modules/, dist/, vendor/, build/, and .git come back into SAST
scope, generating noise and false positives in non-shipped code.

What this PR does

Adds .semgrepignore at the repo root with:

1. Semgrep built-in defaults (carried forward so they are not lost):
   .git, .svn, .hg, build/, vendor/, dist/, *.min.js, .env/,
   .tox/, node_modules/, .npm/, .yarn/, .venv/, __pycache__/

2. Repo-specific non-production paths (test, docs, CI, editor/agent config):

• test/

What stays in scope (NOT ignored)

All production source directories remain scanned. See the file for the full list.

Notes

• Binary packaging tool — src/, keys/ kept (production). Minimal repo.
• This file does NOT affect Semgrep Secrets scans (those use platform path-ignores only).
• Managed by the repo-configure skill (cribl-product-security). 2026-08-19.

Docs: https://docs.semgrep.dev/ignoring-files-folders-code