v0.1.1 — scanner hardening

Fixes five fail-open gaps found in a cross-model security review, so a hostile skill can't slip past the scanner:

• git clone arg injection: a repo URL starting with - (e.g. --upload-pack=…) could be read as a git option and run a command. Now separated with --.
• Oversized files scanned, not skipped: a payload hidden behind 2MB of padding used to be invisible. The first 2MB is now scanned and the file flagged.
• Unterminated / ...-closed frontmatter is parsed: a tolerant parser in the agent would still read those keys, so the scanner does too instead of seeing nothing.
• Arbitrary MCP launch command is HIGH, not MEDIUM (the severity was returned on both branches of a ternary).
• Destructive-delete regex: lookaheads instead of overlapping stars — removes quadratic backtracking and now catches -fr as well as -rf.
• Temp clone directory is cleaned up instead of leaking.

49 tests, labeled corpus floors green.