v3.21.0

## What's New

### 🤖 LLM-Powered Semantic Code Review Agent

This release adds `code-review-agent/` — a new LLM-powered semantic code review tool that uses **intent profiling** to distinguish safe patterns from dangerous ones based on project context.

**The key differentiator:** Same code, different verdicts based on what the project is supposed to do:
- A build tool running `subprocess.run()` with hardcoded commands → **expected** (that's its job)
- An e-commerce app calling `eval(req.query.filter)` → **dangerous** (shouldn't eval user input)
- A file organizer calling `os.remove()` → **expected** (that's its purpose)
- An auth API calling `fs.writeFile(req.body.path)` → **dangerous** (shouldn't write arbitrary files)

### Key Features

| Feature | Description |
|---------|-------------|
| **Intent Profiling** | Reads README, dependencies, and structure to understand project purpose |
| **3 LLM Providers** | Anthropic API, OpenAI API, **Claude CLI** (no API key needed!) |
| **3 Output Formats** | Colored terminal text, JSON, SARIF 2.1.0 |
| **Dynamic Chunking** | Large files split based on token budget, not hardcoded line limits |
| **Dependency Graph** | Resolves JS/TS/Python imports including barrel re-exports |
| **Prompt Injection Defense** | System prompts mark repo content as untrusted input |

### Usage

```bash
cd code-review-agent
npm install
npm run build

# Analyze a project (no API key needed with claude-cli!)
npx tsx bin/cr-agent.ts analyze ../path/to/project -p claude-cli -v

# View intent profile
npx tsx bin/cr-agent.ts intent ../path/to/project -p claude-cli

# Output as SARIF for GitHub Code Scanning
npx tsx bin/cr-agent.ts analyze ../path/to/project -f sarif
```

### Stats

- 17 source files, 9 test files (58 tests), 4 test fixture projects
- Tested live: 18 real findings on VulnApp, ~1 false positive per 15 findings on hardenedapp

### Full Changelog

**New Features:**
- feat: add LLM-powered semantic code review agent (#44)

**Dependencies:**
- chore(deps): bump @hono/node-server from 1.19.9 to 1.19.11
- chore(deps): bump express-rate-limit from 8.2.1 to 8.3.0
- chore(deps): bump hono from 4.12.5 to 4.12.7