semgrep --config=auto Turns main Red, No Code Changed

semgrep ci --config=auto fetches the registry's rules every run, so main turns red the day upstream adds one, with zero code changed. Fix: pin rules and image.