feat(token_security_scanner): operator policy and policy_action (#393)

[Hendobox]

Summary

• Upgrades defi/token_security_scanner to v0.2.0. Every successful scan now includes policy_action, policy_profile, report_schema_version, and report_id. The bundled enterprise_default profile keeps the v0.1 tiers (critical / high / unknown → block, medium → flag, low → allow).
• Operators override thresholds in ~/.config/skillware/token_scan_policy.yaml, TOKEN_SCAN_POLICY_PATH, or a per-call policy_path (tax cutoff, closed-source unknown honeypot, minimum holder count). scan accepts an evm.tokens slug such as degen on base.
• supported_chains marks chains GoPlus does not cover. scan_batch runs up to 5 sequential scans and returns worst_risk_tier. HTTP 429 and 5xx retry once, then fail closed.

Fixes #393

Test plan

• Existing fixtures still land on the same tiers under the default profile
• Operator YAML that sets high_tax_pct: 5 turns a 6% buy tax from flag into block
• token: degen on base resolves to the bundled address
• A non-GoPlus chain id is goplus_supported: false, and scanning Sepolia fails closed
• scan_batch of clean / honeypot / medium reports worst tier critical
• pytest skills/defi/token_security_scanner/test_skill.py tests/test_card_ui_schema.py tests/test_registry_docs.py tests/test_security_audit.py
• python examples/token_security_scanner_demo.py (offline)

[rosspeili]

Fantastic upgrade @Hendobox! 🚀

---

Tip

Process Reminder regarding PR Templates for next time:
The PR body content is great and thorough, but please remember to use the official repository template (.github/PULL_REQUEST_TEMPLATE.md) rather than crafting custom headings, this helps conformity and audit logs.

Best practice: While AI agents can write, commit, and push branch code, PRs should ideally be opened and filled manually by contributors. Still, if you want your AI assistant to open or fill the PR description, instruct the agent to populate the standard .github/PULL_REQUEST_TEMPLATE.md checklist and sections verbatim.

I will merge this as is, resolve a changelog minor conflict and commit history in skill doc post merge <3