fix(scan): inspect extensionless shebang scripts

[vsolano9]

What does this PR do?

Collect extensionless directory entries when their first bytes are a shebang, closing the scanner blind spot for executable scripts named setup, install, or run. The probe reads at most 64 bytes; plain extensionless files remain ignored.

Closes #5

Changes

• add a bounded shebang probe for extensionless files
• add a fixture with a shebang setup and an equally dangerous plain notes file
• prove the extensionless script produces the same findings as equivalent .sh content
• bump the package patch version to 0.1.2 and add the required changelog entry

Validation

• node --test — 12/12 passed
• focused regression repeated 20 times
• real CLI JSON/exit contract: 2 files scanned, critical setup finding, no notes finding
• full suite and real CLI passed on Node 18.20.8 and Node 20.20.2
• node --check across source, bin, and test JavaScript
• npm pack --dry-run — expected 8-file zero-dependency 0.1.2 package
• installed tarball .bin smoke passed
• git diff --check

Checklist

• Tests pass (node --test)
• Updated docs / README if behavior changed (changelog updated; CLI syntax unchanged)
• Added a CHANGELOG.md entry
• Followed the existing code style

Notes

The executable-bit alternative was intentionally not used: a shebang is a precise text-script signal, while an executable bit alone may identify a native binary that should not be decoded and scanned as text.