…esh (#5)

* fix: harden allowlist patterns against ReDoS, enforce full-match semantics

Port the datafog-python 4.7.0 allowlist hardening: reject quantified
groups containing nested quantifiers at config time (catastrophic
backtracking on attacker-influenced entity text), cap pattern length at
512 chars, anchor patterns so a partial match never suppresses a
finding, and skip pattern matching for entities longer than 512 chars
(fail-safe: the finding is kept).

* fix: register tools with parameters/execute to match OpenClaw plugin contract

All 6 tools were registered with schema:/handler:, which the OpenClaw
runtime does not recognize — tool calls failed before reaching the model
(verified against upstream docs/plugins/building-plugins.md; execute
receives (toolCallId, params)). Ported from PR #3, which discovered the
breakage during E2E testing in February. Also declares the six tools in
the manifest contracts.tools block, now required for tool discovery, and
bumps the manifest version to 0.4.0.

* chore: fix npm audit vulnerabilities, bump sharp and vitest

npm audit reported 10 vulnerabilities (2 critical). audit fix cleared
the protobufjs/rollup/tar transitives; the rest were the vitest 2.x dev
chain, cleared by vitest 4. sharp 0.34.5 -> 0.35.3. onnxruntime pins
stay as-is: gliner 0.0.19 (still latest) expects onnxruntime 1.19.x
internals, and the test suite mocks GLiNER so a runtime ABI break would
not be caught here. Adds the openclaw.compat block and Node >=22.19
engine floor now required by the plugin runtime. Version to 0.4.0.

* docs: changelog for 0.4.0