v0.6.1 — fail-safe input hardening

Patch: every public engine method now coerces hostile/garbage input (null, non-string, objects) instead of throwing — a security check must never crash on the input it inspects. Found by an adversarial QA pass; locked in with regression tests.

npm: shellward@0.6.1 · 186 tests + benchmark + ReDoS audit green.