v0.2.5 - Security Hardening & CLI Fix

What's New

Security Hardening (contributed by @snafu4)

• Path traversal protection: IndexStore now validates all file paths written to and read from the cache directory, preventing escape via ../../ style paths in repository file names or symbol metadata
• Owner/name sanitization: _safe_repo_component() validates repo owner and name against an allowlist pattern before use in filesystem paths
• Hardened in: save_index, get_symbol_content, and incremental_save

CLI Fix

• jcodemunch-mcp --help (-h) now exits cleanly with usage info instead of hanging

New Tests

• Path traversal blocked on raw file writes
• Path traversal blocked on symbol content reads
• Invalid owner/name components rejected
• --help exits with code 0

New Docs

• DEEP_THREAT_MODEL.md: STRIDE-style threat model covering all attack surfaces
• REPO_OVERVIEW_AND_SECURITY_AUDIT.md: High-level security posture overview