ci: remove per-repo Semgrep scan (the Semgrep Code app covers PRs) (#780)

## Summary

Removes this repo's own Semgrep scan. The `semgrep-code-hyperpolymath`
GitHub App (Semgrep Managed Scans) already reports
`semgrep-cloud-platform/scan` on every pull request here, so PRs were
scanned twice. No ruleset requires a Semgrep context in this repo
(checked via `rules/branches/main`).

No issue. This is owner-requested estate cleanup (duplicate Semgrep
scanning).

## Type of change

- [ ] 🐛 Bug fix: n/a
- [ ] ✨ New feature: n/a
- [ ] 💥 Breaking change: no. No required check is removed.
- [ ] 🕳️ Soundness fix: n/a
- [ ] 📖 Documentation: n/a
- [ ] 🧹 Refactor / tech debt: n/a
- [ ] ⚡ Performance: n/a
- [x] 🔧 Build / CI / tooling

## 📌 New pins

Head SHA: **`81e3a33a9bc7527557549aeadb3a993427a39a84`**. No pins added
or changed.
- **removed:** `github/codeql-action/upload-sarif@v4.38.2`

## How has this been verified?

Files:
    M	.github/workflows/actions.lock
    D	.github/workflows/semgrep.yml

`actions.lock`: only the Semgrep-specific entries removed (the
`semgrep.yml` workflow key and/or the `returntocorp/semgrep-action` list
item and its dependency block). Every other entry, transitive
dependencies included, is untouched.

- `gh actions-lock --no-fix --json`: findings diffed before/after. **0
new findings**; only findings that belonged to the removed Semgrep
entries disappeared.
- `yq -e .` parses every changed YAML file.

## Checklist

- [x] My commits are **signed** (`git commit -S`, verified `G`).
- [x] I ran the project's own checks/tests locally and they pass: the
workflow checks above. The change is CI-only, so no build or test was
affected.
- [ ] New files carry the correct SPDX identifier: n/a, no new files.
- [ ] Docs are updated: see notes. Prose that mentions Semgrep is left
as is.
- [x] I have not introduced a soundness hole. The coverage change is
flagged below.

## Notes for reviewers

**Coverage change, stated rather than hidden:** the removed workflow
also ran on `push` and `schedule`. The app reports only on pull
requests: no `semgrep-cloud-platform/scan` check exists on `main` HEAD
`bba281c`. Default-branch and scheduled full scans now depend on Semgrep
Cloud's own schedule, which is **not verified** from GitHub.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_013aSu89DNALjTYHBvA6FcoM

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/actions.lock

@@ -54,9 +54,6 @@ workflows:
     '.github/workflows/scorecard.yml': []
     '.github/workflows/secret-scanner.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/semgrep.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.38.0'
     '.github/workflows/spark-theatre-gate.yml': []
     '.github/workflows/stdlib-naming.yml':
         - 'actions/checkout@v7.0.1'