Add OWASP AST02: trust prompt configuration validation

[kw2828]

ClawReins should warn if repository-controlled configuration can auto-execute without user trust confirmation. Check for .clawreins files, skill auto-install settings, and plugin auto-load configs that bypass explicit approval. See OWASP AST02.