fix(audit): catch all write errors so audit failures can't crash requests

security: fail-closed on secret extraction and env var leakage

fix: broaden injection detection patterns

fix: ruff lint — import sorting, unused imports, line length, naming

fix(security): strip punctuation before slashes in URL normalization

fix(security): validate injection tier names, normalize URLs

feat(security): add output validation gate (PII, URL, blocklist)

feat(security): add prompt injection detector with heuristic tier

feat(security): add PII redactor with regex patterns

fix(security): UUID rotation suffix, warn on missing HMAC key

fix(security): rotation collision, HMAC IP hashing, Literal config enums

feat(security): add append-only JSONL audit logger

feat(security): add SecurityVerdict and OutputVerdict types