Aletheore v0.12.0

• Added a tested Java command-injection audit rule for variable commands/executables
  passed to Runtime.exec and ProcessBuilder, including direct array parameters.
  Findings are review candidates; see docs/JAVA-COMMAND-INJECTION-RULE.md for limits.
• Local scan caches now invalidate when parser/endpoint code or installed tree-sitter
  grammars change, even without a package-version bump. Older unstamped caches rebuild
  once instead of serving stale modules or API endpoints.
• Updated MCP agent guidance across full, lean, router and navigation profiles: explain
  snapshot/analysis limits and incomplete output, match setup advice to permitted tools,
  and require authorization and redaction before external diagnostics or issue reporting.
• Added aletheore demo: a real local scan of a clearly labelled synthetic repository,
  showing dependency edges and git hotspots with retained evidence for follow-up queries.
• Added aletheore scan --explain-network: reports conditional registry, external scanner,
  and crash-reporting traffic for resolved settings, then exits without scanning.
• Corrected quickstart network disclosures to include Semgrep metrics and configured
  SonarQube analysis submission.