Scan profiles (internal/config, internal/verdict):
- Agent scan_profile field: strict, content-aware, minimal
- content-aware: only MinimalEnforceRules (TC-001, TC-003, TC-006)
  can block/flag. Everything else logged but verdict is clean.
- Tool-scoped rule overrides: apply_to_tools, exempt_tools on RuleAction
- TC-005 default config: apply_to_tools: [Bash] only
- Default scan profile for auto-registered and hook agents: content-aware
- Eliminates false positives on Edit/Write with HTML, SQL, shell patterns

TUI improvements:
- Event detail: Target, Content preview, Event ID, Session fields
- Animated hexagon logo cycling energy through 4 nodes
- Feed columns reordered: time, agent, status, tool, latency
- Cursor highlight with background color on selected row
- classifyStatus uses PolicyDecision instead of RulesTriggered presence

Infrastructure:
- Gateway starts without backends (hooks-only mode)
- Minimal config includes gateway enabled and TC-005 scoped to Bash
- Hook handler defaults unknown agents to content-aware profile

* feat: scan profiles, tool-scoped rules, TUI polish (#65)

Scan profiles (internal/config, internal/verdict):
- Agent scan_profile field: strict, content-aware, minimal
- content-aware: only MinimalEnforceRules (TC-001, TC-003, TC-006)
  can block/flag. Everything else logged but verdict is clean.
- Tool-scoped rule overrides: apply_to_tools, exempt_tools on RuleAction
- TC-005 default config: apply_to_tools: [Bash] only
- Default scan profile for auto-registered and hook agents: content-aware
- Eliminates false positives on Edit/Write with HTML, SQL, shell patterns

TUI improvements:
- Event detail: Target, Content preview, Event ID, Session fields
- Animated hexagon logo cycling energy through 4 nodes
- Feed columns reordered: time, agent, status, tool, latency
- Cursor highlight with background color on selected row
- classifyStatus uses PolicyDecision instead of RulesTriggered presence

Infrastructure:
- Gateway starts without backends (hooks-only mode)
- Minimal config includes gateway enabled and TC-005 scoped to Bash
- Hook handler defaults unknown agents to content-aware profile

* fix: false positive reduction, TUI accuracy and polish

- Built-in tool exemptions: drop TC-005/MCPCFG on Bash/Write/Edit,
  MCPCFG_004/THIRDPARTY_001 on WebFetch/WebSearch
- Content tools only enforce TC-001, TC-003, TC-006
- Hooks scan profile limited to content tools, not execution tools
- TUI status from PolicyDecision instead of RulesTriggered JSON
- Gateway uses ApplyToolScopedOverrides with tool name context
- DefaultSeverityVerdict now case-insensitive
- Fix nil findings slice producing "null" JSON
- Feed columns use lipgloss Width for alignment
- Event detail: Hash field, dim border
- Logo hexagons active only during agent traffic
- Auto-kill previous oktsec instance on startup
- Remove TC-005 rule from auto-setup defaults