feat: security hardening, tests, doctor command, CI update, CHANGELOG

- Add AES-256-GCM encryption for API keys (internal/secret)
- Add dangerous command detection in terminal
- Add muyue doctor command for system health checks
- Add scanner TTL cache, orchestrator history mutex, shared HTTP client
- Deduplicate MCP config generation, refactor skills YAML parser
- Add XDG-compliant config dir with legacy migration
- Add cleanup on all TUI quit paths
- Add 8 test files (config, workflow, skills, orchestrator, version,
  platform, scanner, secret)
- Update CI to actions/setup-go@v5
- Add CHANGELOG.md, update README and Makefile

🤖 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

.gitea/workflows/ci.yml

@@ -13,13 +13,9 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup Go
-        run: |
-          if ! command -v go &> /dev/null; then
-            wget -q https://go.dev/dl/go1.24.3.linux-amd64.tar.gz
-            sudo tar -C /usr/local -xzf go1.24.3.linux-amd64.tar.gz
-          fi
-          export PATH=/usr/local/go/bin:$PATH
-          go version
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.24.3'
 
       - name: Cache Go modules
         uses: actions/cache@v4
@@ -32,30 +28,22 @@ jobs:
             ${{ runner.os }}-go-
 
       - name: Download dependencies
-        run: |
-          export PATH=/usr/local/go/bin:$PATH
-          go mod download
+        run: go mod download
 
       - name: Vet
-        run: |
-          export PATH=/usr/local/go/bin:$PATH
-          go vet ./...
+        run: go vet ./...
 
       - name: Test
-        run: |
-          export PATH=/usr/local/go/bin:$PATH
-          go test ./... -v -race -timeout 60s
+        run: go test ./... -v -race -timeout 60s
 
       - name: Build
         run: |
-          export PATH=/usr/local/go/bin:$PATH
           go build -o muyue ./cmd/muyue/
           ./muyue version
 
       - name: Build all platforms
         if: github.event_name == 'push'
         run: |
-          export PATH=/usr/local/go/bin:$PATH
           mkdir -p dist
           LDFLAGS="-s -w -X github.com/muyue/muyue/internal/version.Version=$(grep 'Version =' internal/version/version.go | cut -d'"' -f2)"
           CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="$LDFLAGS" -o dist/muyue-linux-amd64 ./cmd/muyue/