[2.9] Add PR body injection scanner (AI Security)

[vbonk]

What needs to be done

Create .github/workflows/scan-pr-body.yml. Scans PR/issue bodies for prompt injection patterns: 'ignore previous instructions', 'you are now', 'system prompt:', base64 blocks, hidden markdown comments. Adds WARNING comment if detected. Does NOT block merge. Commented out by default (opt-in).

Acceptance Criteria

• Workflow detects common injection patterns
• Adds warning comment (not blocking)
• Commented out in template (opt-in)

[vbonk]

Completed in Phase 2 PR #86.