Feature
Review and content scanning
A version passes a content scan before it can be promoted to review.
A package version moves through the approval states draft, pending_review, approved and rejected. `wl push` creates a draft; `wl publish` promotes it to pending_review, which is allowed only after its content scan passes.
The content scan is deterministic and looks for secrets, prompt injection and fields that telemetry must never carry. An optional AI review in the dashboard suggests findings and never blocks.