Security hardening: close 17 findings (3 High, 7 Medium, 5 Low, 2 Info) — fetch safety, schema validation, supply-chain pinning, prompt-injection guardrails#32