chore(llm-security): v7.8.0 — TRG/SIG/AST scanners

Session C of the security-fix track: cut the TRG/SIG/AST release now that the
F-1/F-2/F-3 security gates pass. Pure version-sync — the three scanners shipped
in Steps 1-7 (616e7ff..fc7cf57); no production code changes here.

Version-sync 7.7.2 -> 7.8.0 across every current pointer: .claude-plugin/
plugin.json, package.json, README.md badge, and the CLAUDE.md header + "release
notes" range sentinel. Narrative additions (prior releases kept as history):
- CHANGELOG.md: new [7.8.0] entry (Added: TRG/SIG/AST; Changed: prefix
  registration + knowledge/ packaging).
- docs/version-history.md: new v7.8.0 section describing the three scanners.
- README.md "Recent versions": new 7.8.0 row.
- CLAUDE.md: new v7.8.0 highlights paragraph above the v7.7.2 one.

TRG/SIG/AST recap (built Steps 1-7, behind the security-fix gate):
- TRG (scanners/trigger-scanner.mjs) — trigger/activation-abuse: TRG-shadow /
  TRG-baiting / TRG-broad over name+description frontmatter, decode pipeline
  first (LLM06/AST04).
- SIG (scanners/signature-scanner.mjs) — pure-Node known-malware identity engine
  over raw bytes + decode pipeline; rules in knowledge/signatures.json
  (LLM03/LLM02).
- AST (scanners/ast-taint-scanner.mjs) — parse-only python3 taint helper
  (scanners/lib/py-ast-taint.py) with graceful regex fallback (LLM01/LLM02/AST02).

Release gate: full node --test suite 1863/0 after the doc edits. No scanner,
hook, or command behaviour changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3s6WnubSSrFjAQTLQdVbG

CHANGELOG.md

@@ -6,6 +6,51 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [7.8.0] - 2026-06-20
+
+TRG/SIG/AST — three new deterministic deep-scan scanners targeting the
+skills/agents attack surface (TRG/SIG/AST). Each ships with its own finding
+prefix, OWASP/AST mapping, policy block, fixtures, and graceful-skip
+behaviour. Built behind a security-fix gate: the F-1/F-2/F-3 shell-injection
+and path-traversal fixes landed first. No existing scanner, hook, or command
+behaviour changes. 1863 tests, 0 fail.
+
+### Added
+
+- **TRG — trigger/activation-abuse scanner** (`scanners/trigger-scanner.mjs`).
+  Inspects command/agent/skill `name` + `description` frontmatter for three
+  activation-surface abuses: `TRG-shadow` (name collides with a built-in
+  command/tool and intercepts it), `TRG-baiting` (description uses
+  maximally-activating phrases — "anything", "always", "all files" — to bait
+  indiscriminate invocation), and `TRG-broad` (a generic name plus a
+  universal-applicability claim, so the unit auto-activates beyond its stated
+  purpose). Descriptions pass through the decode pipeline (zero-width strip →
+  homoglyph fold → `normalizeForScan`) first, so obfuscated baiting still
+  trips. Thresholds and the phrase/built-in lists are policy-overridable via
+  `.llm-security/policy.json` (`trg`). OWASP LLM06 (excessive agency); AST04.
+- **SIG — known-bad-identity signature engine**
+  (`scanners/signature-scanner.mjs`). Detects known-malware *identity* —
+  webshells, reverse shells, cryptominers, hacktools — complementary to the
+  shape-based entropy/taint scanners. Unlike a raw byte-matcher (e.g. YARA),
+  every signature is tested against both the raw bytes and the project decode
+  pipeline (base64/hex/url/entity/unicode decode, homoglyph fold, rot13), so
+  obfuscated known-malware is still caught. Rules ship in
+  `knowledge/signatures.json`; families are policy-selectable. OWASP LLM03
+  (supply chain) primary; LLM02.
+- **AST — Python taint analysis** (`scanners/ast-taint-scanner.mjs`). Shells
+  out to a PARSE-ONLY `python3` helper (`scanners/lib/py-ast-taint.py`) for
+  variable-level, scope-aware taint analysis of Python skill code — higher
+  recall/precision than the ~70%-recall regex `taint-tracer.mjs`. The helper
+  only `ast.parse`s the target and never executes it, so analysing hostile
+  code is side-effect-free. Falls back to the regex tracer whenever `python3`
+  is unavailable, so the scan never hard-fails. OWASP LLM01, LLM02; AST02.
+
+### Changed
+
+- `TRG`/`SIG`/`AST` registered as valid finding prefixes
+  (`scanners/lib/output.mjs`); all three wired into the scan orchestrator and
+  policy loader. `knowledge/` added to the `package.json` `files` whitelist.
+
 ## [7.7.2] - 2026-05-19
 
 Language consistency pass. Norwegian had crept into surface text across