New scan

Spawns an agent that installs this package in a disposable SmolVM sandbox, runs its documented usage under instrumentation, and reports a malicious/benign verdict.