Add LLM Safe Haven — runtime protection for AI coding agents

[pleasedodisturb]

Adds LLM Safe Haven to the Agent Firewalls & Gateways section.

• npx llm-safe-haven — auto-detects 14 agents, installs fail-closed hooks, scores posture
• PreToolUse hooks: bash firewall (blocks exfiltration, destructive commands), secret guard (blocks credential writes)
• PostToolUse hooks: JSONL audit logger
• Zero dependencies, 27 kB, published on npm
• Also includes threat model (26+ incidents), 6 hardening guides, 64+ references

[pleasedodisturb]

Friendly status check — this PR has been open since April 27. Sharing fresh maintenance context in case it helps the review:

• May 11 — TanStack npm wave compromised @tanstack/react-router (~12M weekly downloads) via GitHub Actions cache poisoning + OIDC token theft from runner process memory
• May 19 — AntV wave: 323 packages, 637 versions, ~16M weekly downloads. Second confirmed Shai-Hulud variant weaponizing .claude/settings.json as a persistence vector, alongside ~/Library/LaunchAgents/com.user.kitty-monitor.plist and .vscode/tasks.json runOn: folderOpen

Repo has fresh coverage of both waves plus a read-only macOS IOC scanner. Happy to rebase or adjust framing if anything in the entry should be tightened. Thanks for considering!