fix(security): harden 5 adversarial-review findings (M1/M2/M3 + m4/m6) via TDD

Pre-release hardening from an independent adversarial review; each fixed
test-first (failing test -> fix -> green). 214 tests pass.

- entropy (M1): decode-and-rescan now runs BEFORE false-positive suppression,
  so an SRI/media-prefixed injection blob is still decoded and lexicon-rescanned.
  Suppression gates only the entropy finding, never the decode.
- output/disposition (M3): the invisible-carrier invariant now holds on the
  persist gate. scan_output flags zero-width/BIDI presence and disposition
  treats those + lexicon:unicode-tags-present as any-tier carriers, so a carrier
  in model output fails secure even under a trusted policy.
- contract (M2): assert_credential_allowlist catches a bare <PROVIDER>_KEY
  (e.g. STRIPE_KEY) that the old regex silently missed (fail-open). Deliberately
  broad: also flags PARTITION_KEY/SORT_KEY as loud, allowlistable FPs -- fail-loud
  beats fail-silent for an isolation control.
- disposition (m6): guard runs decide inside its guarded block -> total
  fail-closed even on a malformed report.
- output (m4): egress placeholder suppression anchors word markers (example,
  todo, ...) to a word boundary, closing a fail-open where a real secret merely
  containing such a word was suppressed.

Docs: CHANGELOG Security subsection; README honest-limit for lexicon dedup (m5,
documented tradeoff, not fixed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HyRCQMocjZ6SmSQ6JidJ2k

README.md

@@ -113,6 +113,11 @@ that a green scan means safe content:
   `pypdf`/`python-docx`/archive deps). Extract text first, then scan it with the
   high-untrust upload provenance. OCR-embedded instructions and multimodal stego
   in images/PDFs are out of scope beyond the sanitizer's character-layer stripping.
+- **Lexicon findings are deduplicated by pattern id** — `count=1` and the first
+  offset are reported, so the same class matched across several channels/variants
+  collapses to one finding at its first location. This keeps reports readable, but
+  a caller that counts occurrences or needs every offset of a repeated pattern sees
+  only the first: a deliberate readability tradeoff, not full positional coverage.
 
 ## Out-of-scope (documented boundary)