v0.10.1 — security review fixes

v0.10.1 — security review

An independent security pass (separate from the correctness gate). HIGH-1 (prompt-injection neutralization) was already mitigated in 0.10.0; the rest land here.

• HIGH-2 — rl init can no longer clobber settings.json. An existing-but-unparseable file was previously swallowed and overwritten, destroying the user's hooks/permissions/env. init now parses first, backs the file up to settings.json.broken-<ts>.bak, and aborts with a clear message rather than writing.
• MED-3 — ReDoS fixed. The Java/C# enclosing-symbol regex backtracked super-linearly on long whitespace (and ran on every edit). Rewritten bounded; 5000 spaces resolve in <1ms.
• MED-4 — CI supply chain pinned. The demo workflow (contents: write) no longer installs ttyd/vhs at latest.
• LOW-5 — recordHit is throw-proof. It runs right before a deny; a throw would fail-open and silently drop the block. Its I/O is now fully swallowed.

96 tests (5 new security tests) - zero dependencies.