v0.1.7 — detect settings.json auto-approve + directory-symlink escape

Two unledgered false negatives from a security audit, now detected and pinned by tests:

• perm.auto_approve (HIGH): .claude/settings.json permissions.allow entries that pre-approve dangerous or unrestricted commands — Bash(rm -rf /:*), Bash(curl:*), Bash(*)/Bash(:*) — disable the human confirmation prompt. Previously only hooks were scanned; now these are flagged. Benign scoped allows (Bash(npm run test:*), Read(...)) do not false-positive.
• fs.symlink_escape now covers directory symlinks: the scanner walked only files, so a directory symlink escaping the repo (.claude -> /attacker/dir) went undetected. File symlinks stay flagged; internal symlinks stay clean.

Full suite green; benign-repo 0 findings; corpus/misses ledger intact.