Fixes
- sudo re-exec PYTHONPATH order — site-packages now takes priority over the trcc package root, preventing dev clones from shadowing pip-installed dependencies under sudo (#47)
- Fallback instructions on sudo failure — when sudo re-exec fails, prints manual commands instead of exiting silently
- CodeQL cleanup — resolved incomplete URL substring sanitization alerts in tests
Docs
- Added Security section to CLAUDE.md with project-specific security rules