v0.13.3: Body-excerpt key scrub + org migration

Fixed

• Body excerpts are now scrubbed of the real API key before truncation
  ([REDACTED-KEY]), making SECURITY.md's long-standing claim true. Excerpts
  travel into webhook/Telegram alert payloads and the --json snapshot, so a
  server error echoing the key back would have fanned it out to every
  configured alert channel. Scrub-before-truncate also kills the
  key-straddles-the-200-char-boundary case. Locked by new
  BodyExcerptKeyScrubTests in test_security.py.
• Org migration completed in code: GITHUB_URL (advertised in the
  User-Agent) and the raw URLs in update.sh/update.bat now point at
  Yggdrasil-AI-labs instead of surviving on GitHub's rename redirect from
  the old HiroAlleyCat owner.
• Docs told the truth again: SECURITY.md's self-contradictory "No
  shell=True" bullet now accurately describes the one deliberate
  --exec-on-change shell hook and its env-var data transport. README's
  probe table gains the six rows it was missing (badge-catalog, team-id,
  team-me, and the three member-territories variants), the "32 tests" claim
  is corrected to the ~215 that exist, and the webhook payload example no
  longer claims v0.10.0.