Security fixes - #393

Summary

• Security fixes.
• Strengthens inspection coverage and completeness handling across supported skill bundles.
• Preserves deterministic security findings across optional analysis stages.

Why

Some inputs could receive inconsistent analysis coverage or reporting. This change makes incomplete analysis explicit and applies a consistent fail-closed contract to CLI, MCP, JSON, Markdown, terminal, and SARIF consumers.

Impact

• Expands local artifact inspection and normalized security analysis.
• Reports partial or failed inspection explicitly.
• Adds an optional --fail-on-incomplete CI gate.
• Adds sanitized regression coverage without including disclosure-specific fixtures.
• Adds a deterministic external-corpus accuracy gate that records corpus snapshots, scanner revisions, commands, and per-skill/per-rule deltas without committing the corpus.

Validation

• Review-focused regression suite: 101 passed.
• Full local unit suite: 2,274 passed, 13 skipped, 38 deselected, and 4 expected failures in the restricted environment; the seven DNS-dependent tests were rerun with normal network access and passed 7/7.
• ruff check src tests scripts/compare_scan_accuracy.py — passed.
• ruff format --check src tests scripts/compare_scan_accuracy.py — passed.
• git diff --check — passed.
• GitHub Actions is queued for head fb27753.

No changelog entry is included.