fix: harden scripts against injection, SSRF, path traversal

[SAY-5]

Addresses all 9 vulnerabilities from #132 across 6 files:

• Shell injection via sed in batch-runner.sh — switched to awk for placeholder substitution so URL characters like & and | can't escape into shell commands
• Unsafe --dangerously-skip-permissions — removed and scoped worker tools to only what's needed
• Predictable /tmp paths — switched to mktemp with cleanup
• Git injection via VERSION — strict semver validation before any git operations
• Unvalidated remote checkout — re-validates VERSION after fetch
• Path traversal in PDF output — output must stay within project directory
• SSRF in check-liveness — blocks file://, localhost, private IPs, cloud metadata endpoints
• Markdown table injection — escapes pipe and newline in table cells
• Missing .gitignore — added *.bak

Closes #132