bump: v8.1.10 — fix sudo re-exec PYTHONPATH order, CodeQL cleanup, security docs

- Fix _sudo_reexec PYTHONPATH priority: site-packages first, trcc_pkg last
  prevents dev clones from shadowing pip-installed deps under sudo (#47)
- Print fallback instructions when sudo re-exec fails instead of silent exit
- Fix CodeQL incomplete URL substring sanitization alerts in tests
- Add Security section to CLAUDE.md with project-specific rules

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>