Implements the rest of the external review (the trust-critical bin/Codex
pair landed in the previous commit).

Detector blind spots:
- #4 Merge all recognized MCP server maps instead of first-map-wins, so an
  empty `mcpServers: {}` can no longer shadow a populated `servers: {}` in
  Cursor/VS Code configs.
- #3 Diff sensitive MCP fields (env, headers, cwd) on existing servers, which
  serverCommand()-based comparison ignored. A server keeping the same command
  but gaining a secret env var or auth header now surfaces; secret-bearing key
  names escalate to high. Applies to .mcp.json and Codex [mcp_servers.NAME].
  Removals stay silent (narrowing, not widening). New kinds:
  scope_trail.mcp_server_sensitive_field_changed and
  scope_trail.codex_mcp_sensitive_field_changed.
- #5 Model Claude hook entries by (matcher, type, command) rather than command
  alone, so rebinding a guard from one tool to another (same command) is
  caught. NOTE: this reverses the prior "matcher change is noise" decision and
  its test — a PreToolUse guard moved from Bash to Read stops guarding Bash,
  which is a real enforcement-surface change.
- #7 Expand the critical removed-deny pattern set beyond .env/secret/
  credential/.pem to SSH keys, *.key, cloud credentials, registry tokens, and
  kube configs.

Docs & supply-chain:
- #2/#8 Qualify the README "local-only" claim: the scanner uploads nothing,
  but the Action's setup step runs `npm ci` from the registry.
- #9 Pin agent-gov-core to exact 1.3.0 (lockfile kept in sync) so npm
  consumers do not silently resolve a newer parser/schema.
- #10 Note that the benchmark figures bound regressions, not real-world field
  accuracy.

Each change ships unit tests and a labeled benchmark fixture. Corpus grows to
35 cases (27 rogue, 8 benign) across 21 detector kinds; precision/recall hold
at 100%/0% false-positive rate, RESULTS.md regenerated and README counts
synced.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

runDiff materialized the base snapshot, then the head snapshot, and only
assigned `cleanup` after both succeeded. If head materialization threw — an
unresolvable head ref (a shallow checkout missing it), or a max-buffer error
on an oversized config — the base snapshot's temp dir was already on disk and
leaked, since cleanup was never wired up. Clean the base snapshot explicitly
before the error propagates.

Found during a fresh correctness pass over the codebase (not part of the
external review). The existing unresolvable-ref test fails on the *base* ref,
before any dir exists, so it never exercised this path. Adds a regression test
that asserts no scopetrail-snapshot temp dir survives a head-side failure.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>