fix: classify odek self-invocations as system_write (M-3)

[jkyberneees]

Prevents a prompt-injected agent from reaching the human-gated trust mutations (, , ) through the shell tool (M-3).

Changes:

• internal/danger/classifier.go: any shell stage whose program basename is Usage:
  odek run [flags]
  odek run --session [flags]
  odek continue [--id ]
  odek session <list|show [id]|trim |delete |cleanup >
  odek repl [flags]
  odek serve [--addr :8080] [--open]
  odek subagent --goal [--context ] [flags]
  odek init [--global | -g] [--force | -f]
  odek skill <list|view|save|delete|promote|import|curate>
  odek mcp [--sandbox]
  odek telegram
  odek schedule <list|add|rm|enable|disable|run|next|daemon>
  odek memory <list|promote <session_id>>
  odek version

Commands:
run Execute a task with the agent loop
run --session Execute and save conversation as a session
continue Continue the most recent session (or by --id)
repl Interactive REPL mode (multi-turn session)
Accepts --model, --thinking, --sandbox, --prompt-caching, and
--sandbox-* flags just like odek run.
serve Web UI server with WebSocket streaming
Open http://localhost:8080 in your browser.
Features: @ resource completion, session history,
streaming agent responses.
subagent Run a focused sub-task; outputs JSON on stdout.
Spawned by delegate_tasks tool for task decomposition.
Accepts --goal, --context, --task, --timeout, --max-iter.
session Manage sessions: list, show, delete, trim, cleanup
skill Manage skills: list, view, save, delete, import, curate
mcp Start MCP server (Model Context Protocol) over stdio
Exposes all built-in tools for Claude Code, Cursor, etc.
telegram Start Telegram bot (long-polling mode)
schedule Manage native in-process scheduled tasks (cron)
Subcommands: list, add, rm, enable, disable, run, next, daemon
The daemon (or the Telegram bot) fires jobs and delivers
results to stdout, a log, or a Telegram chat.
memory Review and promote past-session memory episodes
list: show episodes excluded from recall (untrusted)
promote <session_id>: approve one so it can be recalled.
Human-gated on purpose — not available to the agent.
init Create a config file (default: ./odek.json)
version Print version and exit

Init flags:
--global, -g Create global config at ~/.odek/config.json
--force, -f Overwrite existing file without prompting

Run flags:
--model LLM model (default: deepseek-v4-flash)
Known profiles: deepseek-v4-flash, deepseek-v4-pro
Profiles auto-set thinking/timeout defaults.
--base-url API endpoint (default: https://api.deepseek.com/v1)
--max-iter Max think->act cycles (default: 90)
--thinking Reasoning depth: enabled, disabled, low, medium, high
Requires a model that supports extended thinking.
Anthropic: forces temperature=1 and needs budget_tokens.
--thinking-budget Max thinking tokens for extended thinking (default: 5000).
--temperature LLM temperature 0.0–2.0 (default: 0 = deterministic)
--no-color Disable colored terminal output
--no-agents Skip loading AGENTS.md from working directory
--prompt-caching Enable prompt caching markers (Anthropic/DeepSeek/OpenAI)
--session Save conversation as a multi-turn session
--learn Enable skill learning mode — on by default, no flag needed
--no-learn Disable skill learning mode (overrides config/default)
--system System prompt override

Skill commands:
odek skill list List all available skills
odek skill view View a skill's full content
odek skill delete Delete a skill
odek skill promote [--force] Promote a tainted skill after review
odek skill import [flags] Import a skill from file:// or https://
Flags: --basic (skip LLM), --yes (auto-approve)
odek skill curate Analyze skills for quality, staleness, overlap
Flags: --apply (apply changes), --interactive (review one-by-one)

Sandbox flags:
--sandbox Run in isolated Docker container
--sandbox-image Docker image (default: alpine:latest)
--sandbox-network Network mode: none (default) | bridge | host
--sandbox-readonly Mount working directory read-only
--sandbox-memory Memory limit (e.g. 512m, 2g)
--sandbox-cpus CPU limit (e.g. 0.5, 2, 4)
--sandbox-user Run as user (uid:gid or name)

Config sources (lowest to highest priority):
~/.odek/config.json Global defaults (shared across projects)
./odek.json Project-level overrides
ODEK_* env vars Environment/runtime overrides
CLI flags Explicit invocation (highest priority)

Environment variables:
ODEK_MODEL LLM model name
ODEK_BASE_URL API endpoint URL
ODEK_API_KEY API key (overrides DEEPSEEK_API_KEY/OPENAI_API_KEY)
ODEK_THINKING Reasoning depth setting
ODEK_MAX_ITER Max think->act cycles
ODEK_SANDBOX true/false — run in Docker sandbox
ODEK_NO_COLOR true/false — disable colors
ODEK_NO_AGENTS true/false — skip AGENTS.md
ODEK_SYSTEM System prompt override
ODEK_SANDBOX_IMAGE Docker image for sandbox container
ODEK_SANDBOX_NETWORK Network mode (none | bridge | host)
ODEK_SANDBOX_READONLY true/false — mount read-only
ODEK_SANDBOX_MEMORY Memory limit (e.g. 512m, 2g)
ODEK_SANDBOX_CPUS CPU limit (e.g. 0.5, 2)
ODEK_SANDBOX_USER Container user (uid:gid or name) now returns .

• Added regression tests in internal/danger/classifier_test.go.
• Updated docs/SECURITY.md and AGENTS.md.