refactor: 7-tool MCP triage surface + SQLite survival tuning #138

Job	Run time
Semgrep (SAST)	24s
Trivy (filesystem + container scan)	14s
OSV-Scanner (SCA)	25s
jscpd (duplication < 3% on touched code)	13s
SBOM (SPDX + CycloneDX)	19s
Gitleaks (secret scan)	7s
	1m 42s

Provide feedback