docs(llm-security): add Table of Contents to README

25 H2 sections, no TOC — long README friction fix per AAA+ B-axis order 32.
Anchors validated against actual headings (see toc_check.py known-positive
control); flat list, mirrors config-audit/README.md pattern.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -15,6 +15,34 @@ A Claude Code plugin that provides security scanning, auditing, and threat model
 
 ---
 
+## Table of Contents
+
+- [Why this exists](#why-this-exists)
+- [Requirements](#requirements)
+- [Install](#install)
+- [First scan](#first-scan)
+- [What's inside](#whats-inside)
+- [Commands](#commands)
+- [Automated hooks (9)](#automated-hooks-9)
+- [Deterministic scanners](#deterministic-scanners)
+- [Agents (6)](#agents-6)
+- [Knowledge base (22 files)](#knowledge-base-22-files)
+- [Coverage at a glance](#coverage-at-a-glance)
+- [Compliance & governance](#compliance--governance)
+- [Workflow examples](#workflow-examples)
+- [Known limitations](#known-limitations)
+- [Project scope](#project-scope)
+- [Non-goals](#non-goals)
+- [Defense philosophy](#defense-philosophy)
+- [Compatibility](#compatibility)
+- [Migrating to v8.0.0](#migrating-to-v800)
+- [Playground (v7.6.0)](#playground-v760)
+- [Self-scan](#self-scan)
+- [Recent versions](#recent-versions)
+- [Changelog](#changelog)
+- [License & attribution](#license--attribution)
+- [Feedback & contributing](#feedback--contributing)
+
 ## Why this exists
 
 Claude Code's extensibility model — skills, MCP servers, plugins, hooks, IDE extensions — creates an attack surface that mirrors the npm/PyPI supply chain problem with one critical difference: **extensions run with LLM agency**. A malicious plugin doesn't just execute code in a sandbox. It can instruct the agent to read your SSH keys, exfiltrate environment variables, install persistence mechanisms, and modify its own configuration — all while appearing to be a helpful "Project Health Dashboard."