aeon-token-pick: add optional VIGIL pre-flight security check

[vigilcodes]

Summary

Adds a pre-flight VIGIL security check to aeon-token-pick so a token pick must pass an onchain security scan before it can be published. If the scan flags a honeypot or returns high/critical risk, the skill escalates to NO_PICK instead.

This is additive only — no existing rules, sample outputs, or thesis/entry/kill/sizing/horizon mechanics are changed. The check is documented as "optional but strongly recommended" so operators who don't want the dependency can skip it.

Why this fits

aeon-token-pick already has a strong discipline: "Falsifiable thesis or no pick" and "NO_PICK is a valid output. Manufactured picks burn capital." The proposed rule extends that same discipline one step earlier — if the token would fail a basic security check, the pick is not safe to publish either. A token-pick skill recommending a honeypot is the exact failure mode the existing skip branch is designed to prevent.

What VIGIL adds

• 6-source consensus verdict in one call (GoPlus + onchain bytecode + market liquidity + deployer verification + community scam DB + liquidity lock)
• Honeypot detection
• Liquidity-lock status (locked/burned/unlocked/unknown — never reports missing data as safe)
• Free, keyless, ~2-3s response, 13 tools live at mcp.vigil.codes
• Submitted to the Bankr catalog as vigil-security-scanner (Add vigil-security-scanner skill (onchain security on Base) #480)

Diff

One rule added, one code-fenced example, plus vigil-security-scanner listed in the existing "Pairs naturally with" line. No deletions.

Tested

• Endpoint live: GET /health → {"tools":13}
• Example call returns the documented JSON shape against USDC on Base
• Public stats: mcp.vigil.codes/stats