sec (3/9): require an active {{target}} in user-defined scanners

[jesse-merhi]

What changes

A user-defined scanner command must contain at least one active
{{target}} placeholder — one that is not inside shell quotes and not after a
# comment. A command with no active placeholder is rejected at
config-resolution time.

Why it matters

The whole point of a scanner command is that ClawScan substitutes the target
path into it. If {{target}} is missing (or only appears quoted/commented), the
scanner runs against nothing — the run looks like it scanned the skill but the
tool never saw it, producing a false "clean". Failing loudly at config time
prevents a silently no-op scanner.

Before / after (runnable)

notarget.yml:

version: 1
profiles:
  demo:
    scanners:
      - id: foo
        command: "scanner --scan"

	Behavior
Before	accepted; scanner runs without ever receiving the target
After	run aborts:

$ clawscan ./skill --config notarget.yml --profile demo --sandbox off --json
User-defined scanner foo in profile demo must include an active {{target}}
placeholder outside shell quotes and comments so the scanner receives the target

A placeholder that is only inside quotes, or only after a #, is likewise
rejected; a normal scan {{target}} is accepted.

Verify

go test ./internal/profiles/ -run 'TargetPlaceholder' -count=1

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: sec (3/9): require an active {{target}} in user-defined scanners This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.