v3.20.0

## New Features

### AIVSS v2 Scoring Engine
- **OWASP AI Vulnerability Scoring System** implementation with per-finding scores (0-10)
- Deterministic formula: `AIVSS = (0.25 × Base) + (0.45 × AI-Specific) + (0.30 × Impact)`
- Heuristic auto-mapping from finding attributes (severity, category, confidence) to AIVSS metrics
- Manual override support for authoritative scoring
- Aggregate posture score with worst-case weighting

### AIUC-1 Compliance Controls
- 16 controls (9 security, 7 safety) from the AIUC-1 framework
- Structured pass/partial/fail/not_evaluated evaluation per control
- Evidence requirements linking to specific scanner tools
- OWASP LLM Top 10 crosswalk for each control

### New MCP Tools
- `score_aivss` — Score findings using OWASP AIVSS v2
- `get_compliance_controls` — Look up AIUC-1 compliance controls

### Report CLI Extension
- `--threat-model --json` flag produces AIVSS posture + compliance output
- Threat model results saved to scan history for trend tracking

### Finding Normalizer
- Unifies 6 different tool output shapes into consistent internal format
- Category inference from ruleId segments
- Severity mapping and confidence normalization

## Bug Fixes
- Fixed path to `test_ast_engine.py` in CI workflow

## Test Coverage
- 79 new tests across 4 test files
- **1404 total tests pass**

## Install
```bash
npm install -g agent-security-scanner-mcp@3.20.0
```

## Usage
```bash
# JSON report with threat model
node index.js report <dir> --threat-model --json

# Score findings via MCP tool
# (accepts output from any scanner tool)

# Look up compliance controls via MCP tool
# (returns structured evaluation criteria)
```

See [docs/threat-model.md](https://github.com/sinewaveai/agent-security-scanner-mcp/blob/main/docs/threat-model.md) for full documentation.