[OdevMatheus]

Closes #191

Summary

• Extends \src/auditor/security.ts\ and \src/auditor/parser.ts\ to detect and block Trojan-Source (CVE-2021-42574) bidirectional control characters, LLM invisible Unicode Tag smuggling (\U+E0000..U+E007F), and zero-width script identifier spoofing.
• Rejects symbolic links and opaque binary/archive files (.exe, .dll, .so, .dylib, .bin, .wasm, .pyc, .zip, .tar.gz) inside Skill and Subagent directories.
• Adds
  esolveSafeRepoTargetPath\ in \src/sync/adapters.ts\ to enforce strict repository boundary containment on all file writes and removals.
• Updates .github/workflows/ai-ci.yml\ and unit tests in \ ests/npx_core.test.ts.