static-analysis: references/rulesets.md recommends p/express, which returns 404

What

plugins/static-analysis/skills/semgrep/references/rulesets.md lists p/express as the framework ruleset for Express, in the "Framework detection hints" table:

Framework	Detection Signals	Ruleset
Express	express in package.json, app.use() patterns	p/express

It is also listed in the JS/TS row of the language table. That ruleset does not exist in the registry:

$ curl -s -o /dev/null -w '%{http_code}\n' https://semgrep.dev/c/p/express
404
$ for r in p/javascript p/nodejs p/security-audit p/secrets; do
    curl -s -o /dev/null -w "$r %{http_code}\n" "https://semgrep.dev/c/$r"
  done
p/javascript 200
p/nodejs 200
p/security-audit 200
p/secrets 200

Impact

Following the selection algorithm on any Express project puts p/express in the approved plan, and that scan dies:

error: Failed to download configuration from https://semgrep.dev/c/p/express HTTP 404.
error: invalid configuration file found (1 configs were invalid)

semgrep exits 7 and run-scans.sh puts it under .failed in scans.json — so this one is handled correctly and gets reported rather than swallowed. The cost is a wasted scan slot and a failure line the user has to diagnose on a plan the skill itself produced.

Suggested fix

Drop p/express from both tables in references/rulesets.md. Express coverage is already in p/nodejs and p/javascript. The javascript.express.* rules that exist ship inside those rulesets — the finding IDs in a normal Node scan are already javascript.express.security.*.

Verified against semgrep 1.176.1.