fix: v5.0.1 — critical bug fixes from code review

- C1: Remove regex g flag in cmdSearch (skipped matches due to lastIndex)
- C2: Escape user input in RegExp constructor (crash on special chars)
- C3: Convert STATE_TEMPLATE to stateTemplate() function (stale timestamp)
- C4: Validate ignorePatterns length to prevent ReDoS
- W3: Path traversal guard on agentId in resolveAgentWorkspace + discoverAgents
- W7: Correct ISO 8601 week number calculation at year boundaries
- W8: Fix false tag dedup with section-specific regex extraction
- Add context-engine-evaluation.md (decision: hooks-only, no CE variant)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

mc-plugin/index.js

@@ -26,6 +26,7 @@ function discoverAgents() {
   // Sub-agent workspaces
   try {
     for (const d of fs.readdirSync(EXTRA_WS)) {
+      if (!/^[\w-]+$/.test(d)) continue;
       const memDir = path.join(EXTRA_WS, d, "memory");
       if (fs.existsSync(path.join(memDir, "CURRENT_STATE.md"))) {
         agents.push({ name: d, memDir });
@@ -233,7 +234,8 @@ function cmdSearch(args) {
     agent = null;
   }
 
-  const re = new RegExp(keyword, "gi");
+  const escaped = keyword.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const re = new RegExp(escaped, "i");
   const results = [];
 
   const searchAgents = agent ? [{ name: agent, memDir: resolveMemDir(agent) }] : agents;