Add LLM Safe Haven — multi-agent security hooks with fail-closed design

[pleasedodisturb]

Adds LLM Safe Haven to the Secrets Management & Isolation section.

• npx llm-safe-haven — detects 14 agents, installs fail-closed hooks, JSONL audit trail
• Hooks: bash firewall (exfil/destructive blocking), secret guard (credential write blocking), audit logger
• SHA256 integrity verification for installed hooks
• Per-agent ignore files (.cursorignore, .codeiumignore, .aiderignore, etc.)
• Zero dependencies, 27 kB, published on npm as llm-safe-haven@0.1.0

[pleasedodisturb]

Friendly status check — this PR has been open since April 27. The project has continued active maintenance against fresh Shai-Hulud waves:

• May 11 — TanStack npm compromise via GitHub Actions cache poisoning + OIDC token extraction from /proc/<pid>/mem
• May 19 — AntV "Here We Go Again" wave: 323 packages / 637 versions / ~16M weekly downloads. Second confirmed wave weaponizing .claude/settings.json SessionStart hook as a persistence vector — exactly the agent-runtime-security threat surface this list curates.

Coverage now includes both new waves + a read-only macOS IOC scanner (scripts/scan-shai-hulud-may2026.sh). Happy to provide more context, rebase if there's been drift, or update the entry if you'd like different framing. Thanks for considering!