repomix: attach_packed_output can bypass file-read secret scanning for supported local files (CVE-2026-49988) | HOL Guard CVE