v1.0.1 — security baseline fix

• Fixes the curl-pipe-shell finding from the omarchyplugins.com automated security baseline (marketplace issue #346) — no shell curl path remains in the repo
• tools/convert_nerd.py now downloads the pinned Nerd Fonts glyphnames.json itself via Python urllib, the same mechanism as tools/check_nerdfonts.py which already passed the baseline
• Downloaded data is parsed as JSON, never executed; regeneration output verified byte-identical, so nerdfonts.tsv is unchanged
• mise run regenerate-dataset stays a single step; the NF_VERSION pin (3.5.0) in mise.toml is unchanged
• mise run install-local no longer copies tools/ into the plugin directory (development tooling only)