tools-bug-scan

Run the repository-native bug scanner (`pnpm bug-scan` / `pnpm bug-scan:changed`), summarize findings by severity and rule, and propose concrete next fixes or targeted rescans.