docs: security ops guide for shell injection validation (#916)

## Gap
PR #916 adds shell injection validation but ships without ops docs.

## What's needed
- Monitor rejected inputs
- Logging behavior
- Troubleshooting false positives

## Depends on
Merge PR #916 first.

Source: docs-opportunity-scanner (2026-04-08)