fix(llm-security): YAML/workflow parser divergence — block scalars + bare if: (#32,#33,#43)

#33 the frontmatter parser collected a block-scalar body (description: |) but did not skip it, so an indented name:/allowed_tools: inside the body re-matched as a top-level key and overrode the real values TRG-shadow and permission checks depend on; the parser now consumes block-scalar bodies as opaque content. #32 block-scalar headers carrying indentation/chomping indicators (|2, >-, |-2) were not recognized, so their bodies never reached the run: injection sink; now matched via a proper indicator/chomping regex.

#43 the B4 actor auth-bypass detector inspected only braced ${{ }} expressions, missing the canonical bare 'if: github.actor == ...' form (Synacktiv Dependabot-spoof false negative); bare if: expressions now emit a synthetic event the detector reads. Suite 2004/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ

scanners/workflow-scanner.mjs

@@ -274,7 +274,7 @@ async function scanFile(absPath, targetPath, stderrLog) {
           `${relPath}: ${ev.expr}.`,
         file: relPath,
         line: ev.line,
-        evidence: `\${{ ${ev.expr} }}`,
+        evidence: ev.bare ? ev.expr : `\${{ ${ev.expr} }}`,
         owasp: 'LLM06',
         recommendation:
           'Use `github.event.pull_request.user.login` (immutable per PR) ' +