Update docs to reflect the broadened GlassWorm-style worm detector

[squid-protocol]

Part of epic #1171. Should land last, once the other sub-issues (#1172-#1176) have actually
merged — the exact counts/category list below depend on which of them land and in what form.

🛑 Problem Statement

gitgalaxy/security/README.md line 35 claims:

It applies highly optimized regular expressions to detect 13 distinct threat categories (e.g.,
Hardcoded Secrets, Memory Corruption, Prompt Injection).

This number happens to still be numerically correct right now purely by coincidence (security_lens.py's
THREAT_SIGNATURES dict has exactly 13 entries as of PR #1169), but the example list doesn't
mention unicode_steganography or self_propagation at all, and the count will silently go stale
the moment any of #1172/#1173/#1175/#1176 add a new signature key. More broadly: the README's
"Engineering Highlights" section documents entropy-based obfuscation detection (Obfuscation Detection (security_lens.py)) but has zero mention of the GlassWorm-style worm-detection
capability at all, despite it being a real, shipped, tested feature since PR #1169 — it's
currently invisible to anyone reading the README.

🎯 Objective

Bring gitgalaxy/security/README.md back in sync with what's actually shipped once epic #1171
lands, and give the worm-detection capability the same visibility the README already gives
entropy-based obfuscation detection.

🛠️ Proposed Implementation

• Update the threat-category count on line 35 to match whatever THREAT_SIGNATURES actually
  contains once Extend self_propagation language coverage: fix dead PHP/Ruby token, add PowerShell + Shell #1172/New signal: credential/token-file targeting (what a worm is actually after) #1173/New signal: persistence / auto-run registration (surviving a reboot) #1175/New signal (needs design pass): bulk environment/secret dump, gated on a nearby network sink #1176 have landed (checking, not assuming — grep -c the dict
  the way this issue's investigation did, don't hand-count).
• Add a new "Engineering Highlights" bullet (matching the existing style/tone of the "Obfuscation
  Detection" and "Shadow Patch & Evasion Detection" bullets) describing the self-propagation /
  credential-targeting / persistence-registration signals and what real-world campaign
  (GlassWorm) motivated them — with the same evidence-first tone the rest of the README uses
  (link to specific signals/tests, not marketing language).
• Check whether obfuscation_flag's SQLite column deserves a mention anywhere docs describe the
  file_data schema (if such a doc exists) now that it reads a real detector instead of a
  hardcoded 0.
• Use the readme-maintenance skill for this — it governs this repo's specific tone/evidence
  rules (claims need paired links/numbers, section ordering is trust-ranked) rather than
  freehanding the update.

✅ Acceptance Criteria

• Threat-category count and example list in gitgalaxy/security/README.md match the actual
  THREAT_SIGNATURES registry contents
• A new highlight bullet describes the worm-detection capability, in the README's existing
  evidence-first tone (see readme-maintenance skill)
• No other doc in the repo is left claiming the old count or omitting the new capability
  (quick grep for "13 distinct threat categories" and similar phrasing repo-wide)