[dannyward630]

Summary

• Decode and secret-scan BOM-marked UTF-16 files regardless of filename extension.
• Keep the existing size cap by quarantining oversized UTF-16 files.
• Add UTF-16LE and UTF-16BE regression coverage for x.reg.

Fixes #105

Validation

• Focused release scanner suite: 74 passed.
• pnpm typecheck: passed.
• CLI build and version/help smoke checks: passed.
• pnpm --filter web build: passed.
• Full suite: 2,683 passed, 3 skipped; one unrelated collection failure in apps/web/tests/personal-kits/kit-enablement-smoke.test.ts (SyntaxError: Invalid or unexpected token).

Assisted by Codex (GPT-6).

[mrgoonie]

Maintainer follow-up (09de062): ASCII behind a UTF-16 BOM decodes to valid CJK, so scanning only the decoded text let a plain-byte secret through (e.g. FF FE + AKIA... in x.reg). The scan now unions the decoded-text and raw-byte readings; regression test added (fails on cfb17cb, passes now).

Local verification on 09de062 (rebased on main 25dabca): pnpm typecheck passed; pnpm test 142 files, 2691 passed / 3 skipped (the earlier kit-enablement-smoke collection failure does not reproduce). CI PR checks green.