Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch (CVE-2026-54316) | HOL Guard CVE