This change set strengthens multiple sandbox escape boundaries, tightens object handling, and expands security regression coverage. (#145)

* This change set strengthens multiple sandbox escape boundaries, tightens object handling, and expands security regression coverage.

  - Added authenticated worker messaging for `python3` and `sqlite3` using per-execution protocol tokens.
  - Hardened Python worker bootstrap:
    - Require `module._load` guard to initialize before execution.
    - Restrict CPython entry/stdlib paths to approved vendor bundle paths.
    - Wrap all worker->parent messages with protocol token.
  - Added `check:python-worker-sync` script and wired it into `pnpm lint` to ensure `src/commands/python3/worker.ts` and generated `worker.js` stay in sync.

  - Expanded defense-in-depth protections:
    - Added trusted-scope depth tracking across async boundaries.
    - Blocked bound callbacks after execution deactivation (`bound_callback_after_deactivate`).
    - Added dynamic import blocking for Node builtins via `module.registerHooks()` when context-aware hooks are available.
    - Added/updated violation types in `src/security/types.ts`.
    - Added additional blocked process globals (`seteuid`, `setegid`, `initgroups`, `setgroups`, `report`, `loadEnvFile`, `setUncaughtExceptionCaptureCallback`).
    - Locked well-known symbol properties in main-thread and worker defenses, now making data descriptors non-writable (effective lock, not just non-configurable).

  - Hardened query-engine object safety:
    - Introduced/expanded `asQueryRecord()` usage across evaluator/path/object/sql/value builtins.
    - Added recursive parsed-data sanitization at parse boundaries.
    - Made `sanitizeParsedData()` cycle-safe (handles alias/self-reference graphs without stack overflow).
    - Tightened safe-object helper expectations around null-prototype object usage and updated tests accordingly.

  - Hardened parser inputs for `jq`/`yq`:
    - `jq` JSON stream parsing now sanitizes parsed objects.
    - `yq` parsers now sanitize parsed outputs across YAML/JSON/XML/INI/CSV/TOML/front-matter/multi-doc paths.
    - Added YAML alias limits (`maxAliasCount`) and disabled XML entity processing (`processEntities: false`).

  - Expanded banned-pattern lint rules and probes:
    - New banned patterns for `Proxy.revocable`, global constructor shadowing, dynamic import/require with non-literal specifiers, `createRequire`, `Module._load/_resolveFilename`, and raw query-engine
  `Record<string, unknown>` casts.
    - Updated lint test fixture and added scoped lint probe.
    - Added explicit `@banned-pattern-ignore` annotations in safe static cases (website PostCSS config, static mocks, controlled fallback/spread sites, warning probe callsite).

  - Added/updated security tests:
    - Worker protocol abuse tests (`python3`, `sqlite3`) for forged token rejection.
    - Queue-timeout test updates for authenticated mock worker messages.
    - Dynamic import builtin defense probe.
    - Combined-chain defense regression probe.
    - Query-engine JS RCE format-variant probe.
    - yq parser security suite (aliases/tags/prototype-pollution/XXE cases).
    - New symbol-locking regression tests.
    - New sanitizeParsedData cycle/reference regression tests.

* Fix lint

* Fix lint2

* Address feedback