Preserve the validated agent-immune scanner refresh

[denial-web]

What changed

• Port the quoted use/mention relaxation into free-text assessment while retaining conservative blocking at MCP tool-call boundaries.
• Add labeled protected-secret output detection without flagging ordinary tokens such as COVID-19, GPT-4, or ISO-8601.
• Add direct/framed injection coverage required by the pinned Doctrine Lab gate.
• Add the Dockerfile and minimal /assess Cloud Run wrapper that produced the deployed service.

Why

The validated refresh was deployed as agent-immune-00002-qx9, but the exact tested source remained only in the local working tree. This draft PR preserves production provenance without changing the existing /assess contract.

Impact

Quoted injection-like text used as data can be allowed or sanitized instead of blocked. Bare commands and structural MCP payloads retain blocking behavior. The Sidekick service URL and request/response contract are unchanged.

Validation

• 198 tests passed.
• 91% line coverage.
• Ruff lint passes for every modified source and test file.
• Doctrine Lab hard/framed pre-deploy and post-deploy gates previously passed with FNR 0 and zero transport errors.
• Current Cloud Run service still points to revision agent-immune-00002-qx9 and image digest sha256:3d694e89ce11c979af1eefa294eeb462016771929f3fbdb9e027c9d6c44c3dbe.

Scope boundary

This PR does not deploy, merge, modify Sidekick, change the global fail-open posture, or include the unrelated local docs/social_posts.md file. The current Ruff formatter would make cosmetic changes to several deployed files; those changes are intentionally deferred so this checkpoint preserves the deployed source bytes.