Deepen Rust Semgrep coverage

[haasonsaas]

Summary

• cover five Rust-specific signal families with bounded Semgrep CE rules for request panics, process execution, filesystem paths, non-cryptographic secret generation, and blocking locks across await
• retain findings when added lines intersect Semgrep's taint source or intermediate trace, while pinning and validating the private 1.139.0 report contract
• add real-core positives, negatives, source-only diffs, provenance collisions, malformed traces, range bounds, and unsupported-target tests

Coverage boundary

The bundled rules continue to withhold coverage for unsafe blocks without safety contracts, public library API panics, and external deserialization without validation because those require context or absence reasoning not modeled by these rules.

Test plan

• go test -count=1 ./...
• ROOM_SEMGREP_CORE=/home/developer/.local/bin/semgrep-core go test -count=1 -tags=semgrep_integration ./cmd/room-semgrep
• semgrep scan --oss-only --metrics off --disable-version-check --strict --validate --config analyzers/semgrep/room.yml
• actionlint .github/workflows/ci.yml