Adds defense-in-depth against obfuscated malicious skill code:
- normalize_input() with NFKC normalization, case folding, and zero-width
character removal to defeat homoglyph and ZWSP evasion.
- PythonSecurityAnalyzer AST visitor detecting eval/exec/compile,
getattr dunder access, and imports of base64/codecs/marshal/types/ctypes.
- Additional regex patterns for getattr builtins chains, __import__
os/subprocess, and nested base64 decoding.
- Integrates all patterns into scan_file(); Python files now get both
normalized regex scanning and AST-based analysis.
Includes full test coverage in tests/tools/test_skills_guard.py.
9a5a299724