chore(llm-security): v7.8.0 — TRG/SIG/AST scanners

Session C of the security-fix track: cut the TRG/SIG/AST release now that the
F-1/F-2/F-3 security gates pass. Pure version-sync — the three scanners shipped
in Steps 1-7 (616e7ff..fc7cf57); no production code changes here.

Version-sync 7.7.2 -> 7.8.0 across every current pointer: .claude-plugin/
plugin.json, package.json, README.md badge, and the CLAUDE.md header + "release
notes" range sentinel. Narrative additions (prior releases kept as history):
- CHANGELOG.md: new [7.8.0] entry (Added: TRG/SIG/AST; Changed: prefix
  registration + knowledge/ packaging).
- docs/version-history.md: new v7.8.0 section describing the three scanners.
- README.md "Recent versions": new 7.8.0 row.
- CLAUDE.md: new v7.8.0 highlights paragraph above the v7.7.2 one.

TRG/SIG/AST recap (built Steps 1-7, behind the security-fix gate):
- TRG (scanners/trigger-scanner.mjs) — trigger/activation-abuse: TRG-shadow /
  TRG-baiting / TRG-broad over name+description frontmatter, decode pipeline
  first (LLM06/AST04).
- SIG (scanners/signature-scanner.mjs) — pure-Node known-malware identity engine
  over raw bytes + decode pipeline; rules in knowledge/signatures.json
  (LLM03/LLM02).
- AST (scanners/ast-taint-scanner.mjs) — parse-only python3 taint helper
  (scanners/lib/py-ast-taint.py) with graceful regex fallback (LLM01/LLM02/AST02).

Release gate: full node --test suite 1863/0 after the doc edits. No scanner,
hook, or command behaviour changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3s6WnubSSrFjAQTLQdVbG

docs/version-history.md

@@ -2,6 +2,52 @@
 
 Per-release notes for v7.0.0 onward. Imported from `CLAUDE.md` via `@docs/version-history.md`.
 
+## v7.8.0 — TRG/SIG/AST: trigger, signature, and AST-taint scanners
+
+Three new deterministic deep-scan scanners ("TRG/SIG/AST"), each with its own
+finding prefix, OWASP/AST mapping, policy block, fixtures, and graceful-skip
+behaviour. They target the skills/agents activation and code surface that the
+permission and shape-based scanners do not cover. Built behind a security-fix
+gate — the F-1/F-2/F-3 shell-injection and path-traversal fixes landed first.
+No existing scanner, hook, or command behaviour changes; full suite green
+(1863 tests, 0 fail).
+
+- **TRG — trigger/activation-abuse** (`scanners/trigger-scanner.mjs`).
+  Inspects command/agent/skill `name` + `description` frontmatter for three
+  activation-surface abuses: `TRG-shadow` (name collides with a built-in
+  command/tool and intercepts it), `TRG-baiting` (description uses
+  maximally-activating phrases — "anything", "always", "all files" — to bait
+  indiscriminate invocation), and `TRG-broad` (a generic name plus a
+  universal-applicability claim, so the unit auto-activates beyond its stated
+  purpose). Skills/agents auto-activate on their description, so this is a
+  skill-native surface not covered by the permission or taint scanners.
+  Descriptions pass through the decode pipeline (zero-width strip → homoglyph
+  fold → `normalizeForScan`) first, so obfuscated baiting still trips.
+  Thresholds and the phrase/built-in lists are overridable via
+  `.llm-security/policy.json` (`trg`). OWASP LLM06 (excessive agency); AST04.
+
+- **SIG — known-bad-identity signatures** (`scanners/signature-scanner.mjs`).
+  A pure-Node signature engine for known-malware *identity* — webshells,
+  reverse shells, cryptominers, hacktools — complementary to the shape-based
+  entropy/taint scanners. Unlike a raw byte-matcher (e.g. YARA), every
+  signature is tested against both the raw bytes and the project decode
+  pipeline (base64/hex/url/entity/unicode decode, homoglyph fold, rot13), so
+  obfuscated known-malware a byte-matcher misses is still caught. Rules ship
+  in `knowledge/signatures.json`; families are policy-selectable. OWASP LLM03
+  (supply chain) primary; LLM02.
+
+- **AST — Python taint analysis** (`scanners/ast-taint-scanner.mjs`). Shells
+  out to a PARSE-ONLY `python3` helper (`scanners/lib/py-ast-taint.py`) for
+  variable-level, scope-aware taint analysis of Python skill code — higher
+  recall/precision than the ~70%-recall regex `taint-tracer.mjs`. The helper
+  only `ast.parse`s the target and never executes it, so analysing hostile
+  code is side-effect-free. Falls back to the regex tracer whenever `python3`
+  is unavailable, so the scan never hard-fails. OWASP LLM01, LLM02; AST02.
+
+Packaging/wiring: `TRG`/`SIG`/`AST` registered as valid finding prefixes
+(`scanners/lib/output.mjs`); all three wired into the scan orchestrator and
+policy loader; `knowledge/` added to the `package.json` `files` whitelist.
+
 ## v7.7.2 — Language consistency pass
 
 Norwegian had crept into surface text across v7.5–v7.7. Per the