feat(security): informational Pass-1 scan on every admission + one-shot baseline sweep

feat(security): informational Pass-1 scan on every admission + one-shot baseline sweep #1329