piscina: Prototype Pollution Gadget → RCE via inherited options.filename (CVE-2026-55388) | HOL Guard CVE