v3.2.0

• New tool secure_this (MCP + CLI secure-this <file>): scans, applies only the fixes that verifiably land — each candidate re-scanned and rolled back if it fails to resolve the issue or introduces a new one — and re-verifies. Turns "warns" into "guarantees the fix landed"
• Ships a definition-of-done gate (status clean/secured/partial/no_autofix + applied/remaining); deterministic, validated across 1028 real files with zero new findings introduced
• 37 tools now, rules unchanged (438); gate green (PASS/A/0)