docs: port ttl-editor's Semgrep posture into this copy, without losing ours

[sgort]

The CI posture page lives in both repositories and had diverged in both directions. This ports ttl-editor's Semgrep work in without overwriting what only this copy has.

Ported from ttl-editor

• The intro paragraph naming a fourth mechanism: Semgrep, which covers the npm dependency tree that check-supply-chain was never able to see
• The Semgrep Code + SCA row in the summary table
• The whole "The other supply chain: the npm tree" subsection under §2, copied verbatim. It was checked byte-identical to ttl-editor's
• §4's account of ttl-editor's ruleset now requiring audit and scan, and its main asymmetry recorded as decided, not merely defensible
• Open-work rows for ttl-editor fix(deps): update frontend dependencies #128 and Return RFC 9457 problem details from every backend error response #131

Kept, because only this copy has it

• "Exercised, at last, in two of the three". ttl-editor's copy is stale here
• The main promotion gate section and the ruleset lessons
• The protected-environment table
• "A workflow's own file in its paths: filter is a trigger"
• "Behind is not the same as diverged"
• Checklist items 10–12, chore(deps): update dependency node to v24 #80, and the 1.9.12 row

After the port, each of the five LDE-only headings was checked for presence. Overwriting either copy with the other would have repeated what ttl-editor's 11f7a78 records: patching a stale copy.

One sentence re-scoped rather than copied

ttl-editor's copy says "every control this document describes now gates acc and none of them gates main". That is true there. It is false here, where the next section describes Linked Data Explorer's own main promotion gate. It now reads as a statement about ttl-editor, with a pointer to the opposite case.

Heads table

ttl-editor's row moves to 7f95502, re-verified. This repository's row stays as its last pass recorded it; I did not update it without re-verifying.

This repository's own gap, now recorded

A new open-work row says what is missing here: no Semgrep scan, so the npm tree is remediated by Renovate and verified by nobody.

A local dry run on cfa6b40 found 86 findings:

• 66 Supply Chain, all transitive and unreachable
• 10 Code in application files
• 6 Code in test files and 4 in examples/

Closing that gap is the next change.

Note for the iou-architectuur patch

This copy is now the more complete of the two. Use it as the source.

Verification

npm run check-format clean. Documentation only.