chameleon 4.5.8

Fixed

• Trust works non-interactively. /chameleon-trust <repo-basename> stalled at the
  interactive confirmation under claude -p, silently stranding the repo untrusted for the
  whole session — the entire guidance layer absent, observed on a graded run. The argument IS
  the typed confirmation: the skill now proceeds directly when it matches, and surfaces the
  expected token when it does not.
• Delimited test/dummy/fake fixture segments are placeholder secrets. gh-test-secret-style
  node:test fixture values fired 14 error-severity secret findings on one graded run. A
  segment-bounded test/testing/dummy/fake marker plus the existing entropy gate drops the
  human-written fixture shape while a real test-mode key (Stripe sk_test_<random>: high
  entropy) and embedded letters (contest-winner) stay flagged.
• describe_codebase names why a bare-basename repo argument resolved to nothing instead of a
  reasonless found: false.