Harden security layer: Semgrep (OWASP/CWE) + OSV-Scanner + govulncheck + Dependabot (HAL-303)

- security.reusable.yml: add Semgrep (p/owasp-top-ten, p/cwe-top-25), OSV-Scanner
  (cross-ecosystem CVEs), govulncheck (Go CVEs on real call paths); keep gitleaks/gosec/Trivy
- .github/dependabot.yml: gomod + npm + actions weekly dependency-CVE PRs
- security-reviewer agent + instructions: review against OWASP Top 10 + CWE Top 25
- sync dependabot.yml into all repos

Synced AI-review standards from hallelx2/dev-standards.

Author: hallelx2

.github/dependabot.yml

@@ -0,0 +1,24 @@
+# Dependency CVE automation. Dependabot opens PRs for vulnerable/outdated deps.
+# Ecosystems with no manifest in a given repo are simply skipped.
+# Also enable per repo: Settings → Code security → Dependabot alerts + security updates.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels: [dependencies, security]
+
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels: [dependencies, security]
+
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels: [dependencies, security]