Add scanner production safety gates

[yanziwei]

Summary

Implements the production scan safety gaps documented in #1645 for scanner-tuning.

Changes:

• Adds a Production Scan Safety Gate covering canary scans, lockout-safe authentication, state-changing web/API controls, target health monitoring, abort thresholds, scanner allowlist governance, fragile system handling, and cloud/API quota budgets.
• Adds SCAN-SAFE-* finding identifiers for common scanner safety failures.
• Extends the authentication record with lockout guardrails.
• Adds a Production Scan Safety section to the output report template.
• Adds a common pitfall warning that non-DoS credentialed scans can still cause outages.
• Bumps the skill version to 1.1.0.

Validation

• git diff --check
• Markdown fence-balance check for skills/vuln-management/scanner-tuning/SKILL.md
• ASCII check for skills/vuln-management/scanner-tuning/SKILL.md
• Required marker checks for SCAN-SAFE-01, Production Scan Safety, Abort thresholds, and Lockout Guardrails

Bounty

Requested as an Improver bounty submission for #1645. Payment details can be provided privately after maintainer acceptance.