chore(llm-security): v7.8.1 — security patch release

Version bump + release notes for the auto-cleaner command-injection fix
(f083cda). Security patch only; no feature changes. 1865 tests, 0 fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ

CHANGELOG.md

@@ -6,6 +6,37 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [7.8.1] - 2026-07-18
+
+Security patch. Fixes a CRITICAL command-injection defect in the auto-cleaner
+that shipped in v7.8.0. No feature changes. 1865 tests, 0 fail.
+
+### Fixed
+
+- **CRITICAL — command injection via scanned filename**
+  (`scanners/auto-cleaner.mjs`). `validateContent()` syntax-checked
+  `.mjs`/`.js`/`.cjs` candidates with
+  ``execSync(`node --check "${tmpPath}"`)``, where `tmpPath` derives from the
+  **untrusted scanned-repo filename**. The F-2 guard added in v7.8.0 checks
+  path containment but neither strips nor quotes shell metacharacters, and a
+  filename containing `"` closes the interpolated quote. A repository shipping
+  a file named ``x";<command>;".mjs`` therefore turned `/security clean` —
+  whose live mode is the documented default — into arbitrary command execution
+  on the operator's machine. Verified with a live proof-of-concept before the
+  fix. Both subprocess call sites (the syntax check, and the CLI's
+  scan-orchestrator fallback) now use `spawnSync` with an argv array, so no
+  shell parses the path.
+- **Defense-in-depth:** `applyFixes()` now refuses findings whose `file` field
+  carries shell or control metacharacters, reporting them as `skipped` rather
+  than passing them to any sink. This guards against a future call site
+  re-introducing string interpolation.
+
+### Changed
+
+- `validateContent` is exported from `scanners/auto-cleaner.mjs` so the
+  regression suite can exercise the subprocess sink directly, independently of
+  the `applyFixes` guard that would otherwise mask it.
+
 ## [7.8.0] - 2026-06-20
 
 Three new deterministic deep-scan scanners (TRG/SIG/AST) targeting the