fix(#2198): remove dead scan exports, correct injection-scan docs

scanEntropyAnomalies + shannonEntropy were dead exports with zero
production callers — the live hooks (gsd-prompt-guard.js,
gsd-read-injection-scanner.js) inline their own pattern subsets for
hook independence and never called these functions.

Changes:
- Remove scanEntropyAnomalies + shannonEntropy from src/security.cts
- Remove scanEntropyAnomalies test block from tests/security.test.cjs
- Correct REQ-SCAN-INJ-02/-03 in FEATURES.md (EN/zh-CN/ja-JP) to
  describe what actually runs live (injection patterns, invisible
  Unicode) vs CI-only (base64-decode, codebase scan)
- Correct docs/security/baseline.md §2.4 to clarify live hooks inline
  patterns, not import from security.cts
- Add regression test asserting the corrected contract
- scanForInjection retained: it serves as the CI codebase-scanner engine

scripts/lint-test-file-count.allowlist.json

@@ -50,11 +50,12 @@
     },
     "security": {
       "files": [
+        "security-dead-exports.regression.test.cjs",
         "security-prompt-injection.security.test.cjs",
         "security-scan.security.test.cjs",
         "security.test.cjs"
       ],
-      "issue": "TBD"
+      "issue": "2198"
     },
     "state": {
       "files": [