* feat: add hidden Unicode character scanner for prompt injection defense
Scans all tracked text files for invisible characters used in LLM prompt
injection, Trojan Source, and supply-chain attacks. Covers tag characters,
BiDi controls, zero-width chars, and all Unicode Cf format characters.
Also detects markdown side-channels (long HTML comments, hidden reference
links). Runs as a pre-commit hook (Lefthook) and CI step on PRs.
* fix: resolve ESLint errors in hidden char scanner
Add Node globals for .mjs scripts in ESLint config. Remove unnecessary
regex escapes in reference link pattern.
Graham Lipsman
966d0f7445