Run semgrep via the mantis_semgrep MCP server and triage results into the candidate/confirmed/rejected lifecycle
