fix(sourcehunt): make Semgrep explicitly opt-in

[ropoctl]

Summary:

• install the SourceHunt extra reproducibly in the container without activating Semgrep
• default Semgrep off in runner/config/CLI and machine API paths
• expose explicit --semgrep and strict machine request semgrep: true|false activation
• propagate the setting through one-shot, watch, webhook, and machine execution
• prefer the Semgrep executable beside the running Python after activation, so absolute venv/systemd launches do not depend on ambient PATH
• reject Semgrep with the proof flow instead of silently ignoring it

Contract:

• installation or discoverability alone never activates Semgrep
• standard/deep depth no longer implies Semgrep
• explicit CLI or machine API policy is required

Tests:

• 38 passed: Semgrep runner/config/CLI/machine/sidecar contract and machine protocol
• 14 passed: flow compatibility and commit-monitor propagation
• Ruff passed on all changed Python files
• git diff --check passed