feat(3.6.6): local/uncensored llama.cpp provider, clippy clean, CI (#40)

Version bump 3.6.5 -> 3.6.6.

Local & uncensored models
- New `llamacpp:` provider (llama-server, OpenAI-compatible, localhost:8080,
  no API key, CPU-only or GPU-offloaded). Override via LLAMACPP_BASE_URL;
  model name is the loaded gguf (pass-through). 15 -> 16 providers.
- README: local/uncensored highlight, provider table + key-less note, badges.

Quality
- clippy clean under `-D warnings`: clamp(), sort_by_key(Reverse), struct-literal
  init, too_many_arguments allows, scoped await_holding_lock on the REPL blocking
  fallback (guard intentionally held across run().await), plus clippy --fix set.

CI
- examples/github-actions/ci.yml: cargo build/test/clippy -D warnings for the
  neurosploit-rs workspace (template, kept out of .github/workflows).


Claude-Session: https://claude.ai/code/session_01QDses7zTSa9YF7pPRjphvh

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -1,4 +1,4 @@
-<h1 align="center">🧠 NeuroSploit v3.6.5</h1>
+<h1 align="center">🧠 NeuroSploit v3.6.6</h1>
 
 <p align="center">
   <a href="https://trendshift.io/repositories/22624?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-22624" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/22624/daily?language=Python" alt="JoasASantos%2FNeuroSploit | Trendshift" width="250" height="55"/></a>
@@ -12,11 +12,11 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/Version-3.6.5-blue?style=flat-square">
+  <img src="https://img.shields.io/badge/Version-3.6.6-blue?style=flat-square">
   <img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
   <img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
   <img src="https://img.shields.io/badge/MD%20Agents-430-red?style=flat-square">
-  <img src="https://img.shields.io/badge/Models-15%20providers-success?style=flat-square">
+  <img src="https://img.shields.io/badge/Models-16%20providers-success?style=flat-square">
   <img src="https://img.shields.io/badge/Modes-Black%20%7C%20White%20%7C%20Grey%20%7C%20Host%20%7C%20AI-9cf?style=flat-square">
   <img src="https://img.shields.io/badge/Auth-API%20key%20%7C%20Subscription-orange?style=flat-square">
 </p>
@@ -108,6 +108,11 @@ Control TUI**.
 - 📸 **Proof screenshots in reports** — agents capture visual proof per finding
   (`evidence/<finding-id>-N.png`), embedded beside its vulnerability in the
   Typst/HTML/Markdown reports.
+- 🖥️ **Local, uncensored & CPU-only models** — `ollama:` and `llamacpp:` run the
+  whole engagement on your box with **no API key** and **no data leaving the
+  host**. `llamacpp:` speaks to a `llama-server` OpenAI-compatible endpoint
+  (`LLAMACPP_BASE_URL`, default localhost:8080); the `model` is whatever gguf you
+  loaded. Ideal for offline/air-gapped work and unfiltered offensive prompting.
 - 🕵️ **Burp/ZAP proxy** — `/proxy <url>` (or `/burp`) routes agent traffic
   through your local intercepting proxy so you can inspect & replay in Burp.
 - 🗺️ **Attack graph & kill chain** — findings mapped to OWASP / CWE / MITRE
@@ -412,7 +417,7 @@ export GROQ_API_KEY=...                    # groq:*
 export TOGETHER_API_KEY=...                # together:*
 export MOONSHOT_API_KEY=...                # moonshot:*  (Kimi K3/K2)
 export OPENROUTER_API_KEY=...              # openrouter:*
-# ollama needs no key (local)
+# ollama / llamacpp need no key (local)
 
 # then run via API (note: NO --subscription)
 ./target/release/neurosploit run http://testphp.vulnweb.com/ \
@@ -442,9 +447,16 @@ Or put the keys in a `.env` and source it (`cp .env.example .env`; edit; `set -a
 | `moonshot:` | `MOONSHOT_API_KEY` | api.moonshot.ai |
 | `openrouter:` | `OPENROUTER_API_KEY` | openrouter.ai |
 | `ollama:` | _(none)_ | localhost:11434 |
+| `llamacpp:` | _(none)_ | localhost:8080 |
 
 Run `./target/release/neurosploit models` for the full provider/model list.
 
+> **Local, uncensored & CPU-only** — `ollama:` and `llamacpp:` run entirely on
+> your box with no API key and no data leaving the host. `llamacpp:` targets a
+> [`llama-server`](https://github.com/ggml-org/llama.cpp) OpenAI-compatible
+> endpoint (override with `LLAMACPP_BASE_URL`); the `model` is whatever gguf you
+> loaded. Ideal for offline engagements and unfiltered offensive prompting.
+
 #### 2) Via subscription (no API key)
 
 `--subscription` drives your local agentic-CLI login instead of an API key —