fix(security): enforce discovery and analysis completeness

[Spectorian]

Summary

• include bounded dot-prefixed child skills while preserving explicit skip directories and link safeguards
• keep requested and executed optional-analysis state distinct across reports and MCP output
• require a complete requested analysis pass for an install-safe MCP verdict while preserving explicit static-only behavior

Validation

• 276 focused and adversarial regressions
• 2,806 non-integration/non-provider tests
• cross-surface JSON and MCP accounting checks
• Ruff lint, format check, targeted mypy, and git diff --check