Harden scanner trust boundaries: non-suppressible permit-all banner + reject in-node_modules PnP runtime #331