fix: sanitise snapshot follow mode; least-privilege CI token
The scan-info view printed the snapshot's "follow" metadata string
unsanitised (the canvas filter was the only defence). The CI workflow
ran with the repository's default GITHUB_TOKEN permissions; it only
needs to read the code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
--compare opens the TUI with growth/shrink colouring unless a report is
requested. treegen builds deterministic synthetic trees (Unicode,
hostile names, sparse files). MAPSIZE_DEBUG_PANIC verifies terminal
restoration on UI and scanner panics.
Andy DixonandClaude Opus 5.5