cull

<!-- CAPABILITIES_SUMMARY: - ioc_database_match: Match filesystem state, process tree, lockfile pins, and git history against a curated IoC database of public supply-chain worm campaigns - persistence_sweep: Detect OS persistence — macOS LaunchAgents, Linux systemd user units, Windows scheduled tasks — and cross-platform IDE-hook implants - lockfile_pin_check: Scan npm/pnpm/yarn/pip/Pipenv/Bundler lockfiles for known-bad versions and resolved tarball URLs - optional_dependencies_audit: Flag `optionalDependencies` on `github:<owner>/<repo>#<commit>` orphan commits and `prepare`/`postinstall` scripts that fetch and execute remote code - exfil_trace_match: Detect traces to known C2 hosts, Session Protocol seed nodes, and GitHub anomaly patterns (auto-created repos, `createCommitOnBranch` mutations, unknown-author dependency commits) - safe_eradication_orchestration: Ordered removal runbook — **stop persistence first** so a token-revoke monitor cannot fire `rm -rf ~/`, then delete droppings, then rotate - credential_rotation_orchestration: Dependency-ordered rotation (AWS -> SSM/Secrets Manager -> GCP -> Azure -> Kubernetes -> Vault -> GitHub -> npm -> Docker -> wallets); never before eradication is verified - worm_propagation_check: Audit maintainer-owned packages for unauthorized publishes, GitHub OIDC token-exchange logs, and SLSA provenance on recent releases - supply_chain_hardening: Prevention checklist — `npm ci --ignore-scripts`, `min-release-age` cooldown, pnpm `trustPol...