fix: security scan self-detection and Windows test compatibility

- Add base64-scan.sh and secret-scan.sh to prompt injection scanner
  allowlist (scanner was flagging its own pattern strings)
- Skip executable bit check on Windows (no Unix permissions)
- Skip bash script execution tests on Windows (requires Git Bash)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/prompt-injection-scan.sh

@@ -67,6 +67,8 @@ PATTERNS=(
 # Files that legitimately discuss injection patterns (security docs, tests, this script)
 ALLOWLIST=(
   'scripts/prompt-injection-scan.sh'
+  'scripts/base64-scan.sh'
+  'scripts/secret-scan.sh'
   'tests/security-scan.test.cjs'
   'tests/security.test.cjs'
   'tests/prompt-injection-scan.test.cjs'