feat: security hardening, tests, doctor command, CI update, CHANGELOG

- Add AES-256-GCM encryption for API keys (internal/secret)
- Add dangerous command detection in terminal
- Add muyue doctor command for system health checks
- Add scanner TTL cache, orchestrator history mutex, shared HTTP client
- Deduplicate MCP config generation, refactor skills YAML parser
- Add XDG-compliant config dir with legacy migration
- Add cleanup on all TUI quit paths
- Add 8 test files (config, workflow, skills, orchestrator, version,
  platform, scanner, secret)
- Update CI to actions/setup-go@v5
- Add CHANGELOG.md, update README and Makefile

🤖 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

Makefile

@@ -4,7 +4,7 @@ BINARY = muyue
 BUILD_DIR = .
 GO = go
 
-.PHONY: build install clean test run scan fmt lint
+.PHONY: build install clean test test-short run scan fmt lint build-all deps vet
 
 build:
 	$(GO) build -o $(BUILD_DIR)/$(BINARY) ./cmd/muyue/
@@ -20,7 +20,13 @@ clean:
 	rm -f $(BUILD_DIR)/$(BINARY)
 
 test:
-	$(GO) test ./... -v
+	$(GO) test ./... -v -count=1
+
+test-short:
+	$(GO) test ./... -v -short -count=1 -timeout 60s
+
+vet:
+	$(GO) vet ./...
 
 run: build
 	./$(BINARY)
@@ -43,6 +49,5 @@ build-all:
 	GOOS=windows GOARCH=amd64 $(GO) build -o dist/$(BINARY)-windows-amd64.exe ./cmd/muyue/
 	GOOS=windows GOARCH=arm64 $(GO) build -o dist/$(BINARY)-windows-arm64.exe ./cmd/muyue/
 
-.PHONY: deps
 deps:
 	$(GO) mod tidy