Security hardening patch

- Prompt injection boundary in NeuroGraft (pasted content treated as user data only)
- Path traversal prevention via API filename allowlist in both installers
- Input validation on -Ref/--ref in both installers
- TLS 1.2/1.3 enforcement in install.ps1
- Private temp directories in both installers (no world-readable /tmp)
- github.ref_name routed through env: in release workflow
- Installer scripts added as release assets with checksums
- .github/CODEOWNERS added for security-sensitive files

Initial release — NeuroGraft v1.0.0

NeuroGraft is a persona transformer meta-agent for GitHub Copilot. It grafts a personality onto any other Copilot agent at one of four cognitive levels, transforming how it thinks, speaks, and reasons while keeping its full capabilities intact.

What's included:
- NeuroGraft agent with four transformation modes (A–D)
- Six archetypes: child, detective, philosopher, pirate, poet, robot
- Two special guests: glados (Portal), jack-sparrow (Pirates of the Caribbean)
- Session persistence — active graft held across conversation turns; cross-session file; resume token on every response
- Agent resolution via workspace, github/awesome-copilot, user paste, or inference
- PowerShell and Bash installers with user-level and repo-level targets
- MIT licence