Evaluate replacing semgrep for PowerShell-aware polyglot policy checks

[DenWin]

Problem

Semgrep is the polyglot structural-linting layer for project-specific policy rules (.config/semgrep/rules/), but it has three real gaps for this template's actual stack:

1. The managed pre-commit hook doesn't work on Windows. pre-commit clones semgrep's own git repo, which contains case-colliding paths that fail checkout on NTFS. A repo: local PyPI-wheel workaround exists (.config/overlays/semgrep/precommit-hook.yaml) but needs require_serial: true to dodge a ~/.semgrep/settings.yml race between parallel instances.
2. PowerShell — this template's primary language — parses but is Pro-gated. Free-tier CLI accepts a languages: [powershell] rule and silently reports 0 findings; real enforcement needs Semgrep Pro (--pro), which is capped at 10 repositories account-wide. Unsuitable for a template cloned into many repos (see .config/overlays/semgrep-pro/README.md).
3. SQL has no semgrep support at any tier.

As a result semgrep was demoted from an active base-template hook + scheduled CI scan back to a pure opt-in overlay (.config/overlays/semgrep/), with the verified rules kept at .config/semgrep/rules/ (currently: Python empty-except, bash blanket-strict-mode) but nothing wired in by default.

Ask

Evaluate an alternative (or a combination) that covers PowerShell natively, ideally without a Windows-hostile install path:

• PSScriptAnalyzer custom rules already fill the PowerShell gap for this template (.config/PSScriptAnalyzerRules/, e.g. Measure-RequireStrictMode) — is that sufficient, or is a single polyglot tool still worth it for the non-PowerShell languages this template's consumers add (Python, bash, C#, etc.)?
• ast-grep — has a PowerShell tree-sitter grammar in some builds; check current support and whether its CLI clones cleanly on Windows.
• Re-evaluate semgrep once Pro's repo cap or pricing changes, or if this account already holds another Pro seat.
• Worst case: keep semgrep overlay-only (current state) and accept PowerShell policy enforcement stays PSSA-only.

Evidence to preserve

Two verified semgrep rules exist and work today when the overlay is activated — keep them as reference/comparison points when evaluating alternatives:

• .config/semgrep/rules/python-no-silently-swallowed-exception.yaml
• .config/semgrep/rules/bash-no-blanket-strict-mode.yaml

Context

• .config/overlays/semgrep/README.md — activation + the Windows/Pro/SQL frictions in detail
• .config/overlays/semgrep-pro/README.md — the Pro-tier gate and 10-repo cap specifically

[DenWin]

not only to replace pwsh, but semgrep all together