cpv-devitalize-threats

Transformation catalog for converting flagged execution-class security findings into provably-inert data — so a plugin passes CPV's security gate by neutralizing the code's executable shape, never by suppressing a rule or relaxing --strict. Maps each threat shape (live os.system / subprocess(shell=True), pipe-to-shell install docs, eval/exec of a string, backtick command substitution, hardcoded bearer tokens in docs, detection-pattern signatures) to a before/after rewrite plus the inert-proof the scanner recognizes. Use when a plugin's security scan reports execution-class findings that must be cleared by making the code provably inert rather than by suppressing rules. Used dynamically via cpv-the-skills-menu by the cpv-plugin-devitalizer-agent agent.