Replace Semgrep, Trivy, and Gitleaks scripts with one scan gate

The merge request is green, then release is blocked by a secret or dependency CVE—usually because Semgrep, Trivy, and Gitleaks each own a job: three logs, three exit codes, no shared Finding, no share