#opengrep

Replace Semgrep, Trivy, and Gitleaks scripts with one scan gate

When CI runs three scanners with three logs, fold them into one job, one Finding model, and one gate—plus a Semgrep migration checklist.