orch-build-mvp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path reads a user-provided design/spec document (“doc path as its argument”), parses it to extract scope/feature list, and uses it to generate gan-harness/spec.md and gan-harness/eval-rubric.md.