Adds 12 security-focused ESLint rules (unsafe-regex, eval, timing attacks, child-process, bidi-characters, etc). One legitimate non-literal RegExp in answers.ts suppressed with inline comment. CI already runs pnpm lint + pnpm audit for SAST coverage. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>