add-and-validate-guardian-developer-semgrep-rule

From README

write a semgrep rule and add it to guardian guardian scans every file claude writes or edits. a custom rule makes it catch something the deployment's ruleset does not — a project convention, a deprecated internal api, a footgun this team keeps hitting. rules live in two places, both read on every scan: /.semgrep/guardian-rules/ — user scope, follows the user into every repository /.semgrep/guardian-rules/ — repo scope, follows the code, so everyone who clones it gets the rule add rules with adddevelopersemgreprule rather than writing into those directories by hand: it resolves the scope's directory and will not write over a rule already there. it does not check the rule itself or count it against the deployment's limit — that happens when a scan reads the rules, and step 5 is how you find out. a file can hold one rule or a rules: list. a file that fails to parse is rejected whole, so rules kept in one file are sent together or not at all.