chore(ci): dogfood self-scan job gated with --fail-on high

Runs CSReview against its own repository on every PR (Semgrep installed,
update check skipped) and fails the build when HIGH/CRITICAL findings
remain — exercising the new CI gate end to end.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: dev-ecd-dm

.github/workflows/ci.yml

@@ -57,3 +57,29 @@ jobs:
 
       - name: Verify package contents
         run: npm pack --dry-run
+
+  self-scan:
+    name: Self-scan (dogfood, --fail-on high)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: csreview/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: csreview
+
+      - name: Install Semgrep
+        run: python -m pip install --upgrade semgrep
+
+      - name: Run CSReview against its own repository
+        run: node csreview/src/cli.js . --agent-name ci --no-update-check --fail-on high