feat(qa): align security scans with nox

docs/development/quality-automation.md

@@ -17,8 +17,8 @@ nox -s lint              # Ruff linting
 nox -s format            # Ruff formatting
 nox -s typecheck         # Pyright type checking
 nox -s unit_tests        # Behave unit tests
-nox -s coverage_report   # Coverage (must be >85%)
-nox -s security_scan     # Bandit security scanning
+nox -s coverage_report   # Coverage (must be >=97%)
+nox -s security_scan     # Bandit + Semgrep + Vulture security scanning
 nox -s dead_code         # Vulture dead code detection
 nox -s complexity        # Radon complexity analysis
 nox -s pre_commit        # Run all pre-commit hooks
@@ -75,10 +75,10 @@ The CI pipeline runs on **Forgejo Actions** (`.forgejo/workflows/ci.yml`).
 | ----------- | ------- | ----------------------------------- | ---------------------- |
 | `lint`      | Push/PR | Ruff format + lint check            | Blocks merge           |
 | `typecheck` | Push/PR | Pyright type checking               | Blocks merge           |
-| `security`  | Push/PR | Bandit + Vulture                    | Blocks merge           |
+| `security`  | Push/PR | Bandit + Semgrep + Vulture          | Blocks merge           |
 | `quality`   | Push/PR | Radon complexity check              | Blocks merge (grade F) |
-| `behave`    | Push/PR | BDD tests (Python 3.11-3.13 matrix) | Blocks merge           |
-| `coverage`  | Push/PR | Coverage measurement                | Blocks merge (<85%)    |
+| `unit_tests`| Push/PR | Behave BDD tests (Python 3.13)      | Blocks merge           |
+| `coverage`  | Push/PR | Coverage measurement                | Blocks merge (<97%)    |
 | `build`     | Push/PR | Wheel build                         | Blocks release         |
 | `docker`    | Push/PR | Docker image build + test           | Blocks deployment      |
 | `helm`      | Push/PR | Helm chart lint + template          | Blocks deployment      |
@@ -113,7 +113,7 @@ Custom rules in `.semgrep.yml`:
 - `no-os-system`: Warns on `os.system()` (use `subprocess.run`)
 - `no-pickle-loads`: Warns on `pickle.loads()` (use JSON)
 
-**Note:** Semgrep is optional. Install with `pip install semgrep` for full scanning.
+**Note:** Semgrep is a project dependency (included in `[project.optional-dependencies.dev]`). It runs automatically in the `nox -s security_scan` session and as a pre-commit hook.
 
 ## Dead Code Detection
 
@@ -146,12 +146,12 @@ Radon measures cyclomatic complexity:
 `scripts/check-quality-gates.py` aggregates all quality checks:
 
 ```bash
-python scripts/check-quality-gates.py --coverage-min 85 --complexity-max F
+python scripts/check-quality-gates.py --coverage-min 97 --complexity-max F
 ```
 
 Gates checked:
 
-1. Coverage >= 85%
+1. Coverage >= 97%
 2. Pyright: 0 type errors
 3. Bandit: 0 high-severity security issues
 4. Vulture: 0 dead code findings
@@ -179,6 +179,7 @@ Only as a last resort, add to `[tool.bandit]` `skips` in `pyproject.toml`.
 
 Add the symbol name to `vulture_whitelist.py` with a comment explaining why.
 
-### Coverage below 85%
+### Coverage below 97%
 
 Run `nox -s coverage_report` to see which lines are uncovered, then add Behave scenarios.
+Coverage must be >=97% for CI to pass. The threshold is defined by `COVERAGE_THRESHOLD` in `noxfile.py`.