docs+chore: add README Security section; fix lint regressions on main

- README: add a visible ## Security section (official sources, vuln reporting via SECURITY.md, GateGuard/IOC/AgentShield guardrails, security guide); make stats line a plain paragraph to clear MD028
- eslint: empty catch comment in run-with-flags.js; drop unneeded escape in github-coordination/parsing.js; remove unused execFileSync import in its test (#2236 follow-ups)
- markdownlint: wrap bare URLs in rules/vue/*.md (#2250 follow-up)

npm run lint green; full suite 2836/2836.

scripts/hooks/run-with-flags.js

@@ -100,9 +100,8 @@ function getPluginRoot() {
   return path.resolve(__dirname, '..', '..');
 }
 
-
 //Safely extract target context from hook stdin JSON for dry-run preview.
- 
+
 function extractTargetContext(raw) {
   const result = { tool: '', filePath: '', command: '' };
   if (!raw || typeof raw !== 'string') return result;
@@ -118,18 +117,16 @@ function extractTargetContext(raw) {
       }
     }
   } catch {
+    // best-effort field extraction; ignore malformed input
   }
   return result;
 }
 
 // Build the [DryRun] preview line for stderr.
- 
+
 function buildDryRunPreview(hookId, relScriptPath, profilesCsv, raw) {
   const ctx = extractTargetContext(raw);
-  const parts = [
-    `[DryRun] Hook "${hookId}" would execute: ${relScriptPath}`,
-    `(enabled=true, profiles=${profilesCsv || 'default'})`,
-  ];
+  const parts = [`[DryRun] Hook "${hookId}" would execute: ${relScriptPath}`, `(enabled=true, profiles=${profilesCsv || 'default'})`];
 
   if (ctx.tool) {
     parts.push(`tool=${ctx.tool}`);