v3.19.0 — secure_prompt: prompt-level security (shift left)

• New MCP tool secure_prompt (tool 38): analyzes a coding prompt BEFORE code is written and returns a deterministic enhancement directive — triage verdict (NO_MOD passes well-specified secure prompts through untouched / LIGHT_MOD injects missing security constraints / HEAVY_MOD also surfaces clarifying questions), detected stack + attack surfaces, and severity-ranked security requirements with rule-id tags. No LLM calls, no network — same prompt = same directive.
• Rule matching pulls code-level rules only (version-pin/manifest advisories excluded by language), dedupes near-identical guidance, caps at the top 8 by severity; the optional context input enriches stack info but can never escalate a non-security prompt.
• Runtime server description and the Gemini extension manifest re-synced with the real rule/tool counts and now enforced by the consistency test suite.