capability-scope-expansion-watcher

Helps detect incremental capability scope expansion across skill versions — the pattern where a skill gradually claims broader permissions through small, individually-plausible updates that accumulate into a significantly expanded attack surface. v1.1 adds risk-class contradiction detection.