Security hardening for companion tool crapper when invoked by /ub-mode agents (PR unclebob/crapper#27) #10

Context

Since /ub-mode instructs coding agents (Claude Code, Cursor, Grok) to automatically execute crapper during the Then Make it Right phase (CRAP < 10), agents frequently invoke crapper against freshly cloned or third-party repositories.

We conducted a security review of the companion unclebob/crapper tool and submitted a minimal /ub-mode-compliant patch (unclebob/crapper#27 / Issue unclebob/crapper#26) that hardens two boundary checks:

1. Vitest coverage provider auto-install (src/crapper/runners.py, CWE-829):
   • Validates that version read from node_modules/vitest/package.json matches strict SemVer (_is_valid_semver) and passes --ignore-scripts to npm install --no-save --no-package-lock when auto-installing @vitest/coverage-v8.
2. JaCoCo XML <!DOCTYPE> internal subset stripping (src/crapper/coverage.py, CWE-776):
   • Ensures <!DOCTYPE ... [ ... ]> internal DTD subsets are completely stripped prior to ET.fromstring().

Sharing here for visibility so /ub-mode users running automated quality gates in CI/agent harnesses can track the companion tool hardening.