Test repo for Semgrep SAST inline PR comments.

Open a PR against main to trigger the security scan. Findings appear as inline review comments on the PR diff.