The Missing Layer: Static Security Analysis for CLAUDE.md and AGENTS.md

OWASP LLM Top 10 risks live in your instruction files. Runtime evals don't lint them. Here's what static security analysis catches — with a concrete finding.