[codex] add security MCP and Vigil integration

[Aroxora]

What changed

• Added PatchPivot's guarded headless security MCP server for Windows, Kali WSL, Ghidra headless, findings, policies, and artifact manifests.
• Added Vigil by Trenchwork integration helpers, project MCP config generation, findings export, docs, and schema coverage.
• Expanded README/SOP/docs for security workflows, Windows-native lab usage, and no-GUI controls.

Why

PatchPivot now has a reproducible control plane for defensive variant-analysis work and can be mounted by Vigil as patchpivot-security while keeping scope, logs, artifacts, and disclosure evidence in this repo.

Validation

• node --check scripts\mcp\patchpivot-security-mcp.mjs
• node --check scripts\mcp\self-test.mjs
• node --check scripts\vigil\patchpivot-vigil.mjs
• JSON parse check for package/config/schema files
• npm run mcp:self-test --silent
• npm run vigil:smoke --silent
• git diff --check --cached