feat(security): add security hardening guide and hooks v3.6.0
- Add guide/security-hardening.md (~10K) covering:
- MCP vetting workflow with CVE-2025-53109/53110, 54135, 54136
- Prompt injection evasion techniques (Unicode, ANSI, null bytes)
- Secret detection tool comparison (Gitleaks, TruffleHog, GitGuardian)
- Incident response procedures
- Add 3 new security hooks:
- unicode-injection-scanner.sh: zero-width, RTL, ANSI escape detection
- repo-integrity-scanner.sh: scan README/package.json for injection
- mcp-config-integrity.sh: verify MCP config hash
- Update existing hooks:
- prompt-injection-detector.sh: +ANSI, +null bytes, +nested cmd
- output-secrets-scanner.sh: +env leakage, +generic tokens
- Update cross-references in ultimate-guide.md (§7.4, §8.6)
- Move MCP Security Hardening to Done in IDEAS.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
34b2ca7200