update-mascots

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The script reads outsider-authored free text from sibling projects’ prompt files (e.g., image-prompts.md / README.md / docs/prompts/* / docs/learning-graph/*) via prompt_path.read_text(...) in extract_character_name(), and that text is then used to generate derived markdown files (including docs/list-mascots.md and per-mascot index.md).