v3.1.38

• VG434 (Drizzle) retargeted from the safe sql${value} tag to the real injection vector: sql.raw() in an executed query
• VG514 no longer flags docker-compose env-var references (${VAR}); VG001 skips kebab-slug enum values and mock/placeholder values
• VG139 skipped in test files and no longer matches a skipVerify substring; real rejectUnauthorized:false still fires