v0.5.39 — Registry Scanner Block + P2 Batch-2

v0.5.39 — Registry Scanner Block + P2 Batch-2

Combines a security-hygiene block of a registry scanner (10th application-layer block, forensics from AY+AZ) with the second batch of SonarCloud P2 dup-literal constant extractions. Defense outcome: zero handler reached on the new actor (400 prior requests, zero leak).

What changed

• Tenth scanner blocked — an automated MCP/OAuth surface-enumeration scanner with self-identified registry UA; 5-day cron-like pattern; never reached a real handler. BLOCKED_IPS: 10 entries total (was 9).
• SonarCloud P2 batch-2 — 8 module-level constants extracted from 25 duplicated string-literal occurrences across the LLM provider config and the agent dispatch surface (provider default models + agent role names + master prompt filename). Behavior-identical refactor; identical wire output.

Why

A routine forensic sweep surfaced the registry scanner; the application-layer block trims upstream noise without changing the legitimate path. The constant extractions continue the credibility-through-clean-internals work started in v0.5.32 / v0.5.39's batch-1 (#238) — every extracted literal is a smaller surface for drift.

PR: #239