🏗️🔧：point semgrep at the branch we have

[DerekNonGeneric]

semgrep.yml came from the vendor's template, which rescans when the workflow
file itself changes, on main or master. This repository has neither, so
that trigger has never fired. It now names live.

Scope

This is narrower than it might look, and worth stating plainly so nobody reads
it as a security gap that was open:

• pull requests — running throughout, 39 runs
• weekly schedule — running, last fired 16 Aug, passing
• push — never fired, and paths-limited to this one file, so it only ever
  meant "rescan after editing the workflow"

Nothing was unscanned. The trigger was dead config, of the same kind as the
Lint and test badge in #1830: a branch name that does not exist here.

Verification

Merging this should fire the trigger it fixes, since the push lands on live
and touches .github/workflows/semgrep.yml. If a push run appears for
Semgrep afterwards, it works.

Not done here

The paths filter means live is still only scanned weekly and per pull
request, never on what actually lands. That is a defensible place to stop, but
if you want the squashed result scanned the way #1830 now lints it, dropping
the paths filter is the change. Left alone deliberately.

[netlify]

✅ Deploy Preview for gh-pages-openinf ready!

Name	Link
🔨 Latest commit	29960b3
🔍 Latest deploy log	https://app.netlify.com/projects/gh-pages-openinf/deploys/6a84bdae8b7c9600082cba06
😎 Deploy Preview	https://deploy-preview-1831--gh-pages-openinf.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[openinf-commit-queue]

The commit queue did not land this. See https://github.com/OpenINF/openinf.github.io/actions/runs/32160179962 — the label has been taken back off, so re-applying it is a deliberate second try.

[openinf-commit-queue]

The commit queue did not land this. See https://github.com/OpenINF/openinf.github.io/actions/runs/32160425459 — the label has been taken back off, so re-applying it is a deliberate second try.

[openinf-commit-queue]

The commit queue did not land this. See https://github.com/OpenINF/openinf.github.io/actions/runs/32181528999 — the label has been taken back off, so re-applying it is a deliberate second try.