Move DOCKERHUB_USERNAME from vars to secrets so merge-docker can access credentials without its own environment scope. This eliminates the redundant double approval since build-docker already gates on release-publish.
Bring in changes from shannon-npx: npx-distributable CLI package (cli/), semantic-release CI/CD workflows, ephemeral per-scan worker containers, TOML config support, setup wizard, and workspace management. Preserves all shannon-only changes: security hardening (localhost-bound ports, MCP env allowlist, path traversal guard), updated benchmarks (XBEN 19/31/35/44), README assets, and prompt injection disclaimer. Applies security hardening to cli/infra/compose.yml as well.
ezl-keygraph