v0.6.1 — Scoring-bypass fix: prefixes and path verbs no longer hide destructive commands

A security-relevant fix. Two ways to silently downgrade a destructive command from CRITICAL to LOW — which also suppressed the pre-execution undo snapshot (the hook only snapshots on critical).

The holes: the command-class analyzers (git / docker / sql / packages / find / rsync) matched the command verb positionally on the raw string, so either an env/wrapper prefix or an absolute path to the binary disengaged the entire oracle layer:

• FOO=bar git clean -fdx · env FOO=bar … · sudo … → scored LOW instead of CRITICAL
• /usr/bin/git clean -fdx · /bin/rm -rf .env → scored LOW (root cause: parsed["command"] kept the full path, so the command == "git" triage gate missed)

Honest agents hit the first case constantly (NODE_ENV=production npm …, PYTHONPATH=. pytest), so real-world verdicts were quietly degraded — not only an evasion concern.

The fix:

• All six class tokenizers now route through a shared peeled_tokens() helper that drops env-assignment and exec-wrapper prefixes, replacing per-analyzer ad-hoc sudo-only exceptions.
• parse_command basenames the verb (_verb_basename) so a path verb classifies as its verb; real_command_verb reuses the same helper.
• Every prefix/path form now scores identically to the bare command.

Verification: independently reviewed across two adversarial passes (the first surfaced the path-verb sibling bug; the second confirmed the combined fix is regression-free). 510 tests pass — 10 new in tests/test_env_prefix.py pinning both invariants — and the labeled eval holds at F1 1.00.

No API changes. Upgrade is a drop-in for anyone running the hook or MCP server.