Content scans and AI findings

Every package version has a content scan, a deterministic scan whose pass or fail result gates promotion: a version can only be promoted once its scan has completed without failing.

AI analysis is separate and advisory. When an organization opts in, `wl review` and the dashboard produce AI findings on bugs, security and improvements. An AI finding never gates, approves or changes a trust class. `wl review --local` sends the files it analyzes to the configured AI provider, so it is for directories without production secrets.