fix: harden scanner quality paths

[limaronaldo]

Summary

• Split the CLI command implementations into focused modules while keeping the public command surface unchanged.
• Harden shell backtick parsing and SHIELD-016 unsafe deserialization detection, including comment/string/doc false-positive coverage.
• Remove unused direct Rust dependencies and update parser docs for the current Python regex parser behavior.
• Add a harness PR-title policy guard that rejects titles containing [codex].

Verification

• rtk cargo fmt --check
• rtk cargo test
• rtk cargo clippy -- -D warnings
• rtk cargo test --workspace --all-features
• rtk cargo clippy --workspace --all-targets --all-features -- -D warnings
• rtk cargo check --no-default-features --all-targets
• rtk cargo check --no-default-features --features python --all-targets
• rtk cargo machete
• rtk npm run compile in vscode/
• Targeted CLI smokes for SHIELD-001 shell backticks and SHIELD-016 pickle.loads
• rtk bash docs/harness/bin/doctor.sh
• rtk bash docs/harness/bin/sensors.sh docs
• rtk bash docs/harness/bin/sensors.sh quick
• rtk bash docs/harness/bin/pr-title-policy.sh --current-pr

Review

• Post-fix code-quality review: APPROVE, no blockers.
• Harness PR-title policy review: PASS, no blockers.