security-review

Local security review of git changes: deterministic scan + Security reviewer over the diff. No API key, no SDK.