chore(lint): adopt the shared security lint rules

[leemour]

Task

Adopt the shared security lint rules from community #12.

Why

community #12 added security/noSecrets (entropy threshold 50) and four GritQL plugins to the shared Biome base. Each repository runs its synced copy in config/wirecat/, so the rules only apply here once that copy is updated.

What

• config/wirecat/: re-synced with community/scripts/adopt-standards.py at community 60a8857, adding no-shell-true, no-exec-interpolation, no-new-function (errors) and no-unbounded-spread (warning).
• performance/tasks/duplicates/evaluate.mjs: reasoned biome-ignore on the published package's sha512 integrity hash (not a key).
• biome.json: the script rewrote !**/.worktrees to !.worktrees (the old pattern also excludes the worktree itself, so lint inside one checked nothing).

Testing

• pnpm lint passes; pnpm standards:check passes.
• noSecrets hits: 1. Plugin errors: 0. Spread warnings: 2, left as they are; they do not block.
• Plugins confirmed to load: a scratch file with new Function and shell: true gave 2 errors.

🤖 Generated with Claude Code