[datlechin]

Summary

• .oss-scanner/Dockerfile: build image for Anthropic's OSS Scanner. Builds the Linux app and its tests, and the TableProCore targets that compile on Linux.
• .oss-scanner/swift/Package.swift: those TableProCore targets (SQL grammar, SQLite authorizer, log redaction and three small ones) as a Linux package. The Dockerfile links their folders in.
• .oss-scanner/threat_model.md: untrusted inputs, the components that matter, how to run tests in the image, the severity scale, what to leave alone.
• AGENTS.md: the folder in the repository map.
• No app code changes.

Test plan

• tools/check --no-shell tablepro from anthropics/oss-scanner, pointed at this branch, on an x86-64 runner: https://github.com/TableProApp/TablePro/actions/runs/39389235750
• Image build: 16 min on 4 CPUs (the scanner allows 45 on 16). meson test 7/7 OK, swift test passes.
• In the built image with no network, 2 CPUs and 8 GB (the scanner's agent limits): cargo test -p tablepro-core and swift test rebuild after an edit and pass offline.