fix: resolve ClawHub suspicious scan for youmind-wechat-article

[DophinL]

Problem

youmind-wechat-article flagged as Suspicious on ClawHub with three reason codes:

• suspicious.dangerous_exec — wildcard Bash(python3 scripts/*) and Bash([ -n "$YOUMIND_API_KEY" ] *)
• suspicious.potential_exfiltration — execSync in mermaid-processor.ts, fetch calls in wechat-api.ts/image-gen.ts
• suspicious.llm_suspicious — compound of the above

Fixes

1. Narrowed allowed-tools

Before (wildcards):

- Bash(node dist/cli.js *)
- Bash(python3 scripts/*)
- Bash([ -n "$YOUMIND_API_KEY" ] *)

After (explicit subcommands):

- Bash(node toolkit/dist/cli.js convert *)
- Bash(node toolkit/dist/cli.js publish *)
- Bash(node toolkit/dist/cli.js stats *)
- Bash(node toolkit/dist/cli.js learn-edits *)
- Bash(node toolkit/dist/cli.js build-playbook *)
- Bash(python3 scripts/fetch_hotspots.py *)
- Bash(python3 scripts/seo_keywords.py *)
- Bash(python3 scripts/validate_skill.py *)

2. Removed YOUMIND_API_KEY from requires.env

The key is recommended but not required. Scanner flags optional vars in requires.env as 'unnecessary credential exposure'.

3. Expanded .clawhubignore

Added toolkit/src/ and toolkit/tsconfig.json — the TypeScript source containing execSync and fetch calls no longer gets uploaded. Users build locally via npm run build.

Version bump

1.0.0 → 1.0.1 to trigger re-publish after merge.