chore(beads): Add VFS security review bugs from Codex PR #12 review

8 issues created:
- flapi-1jr: P0 - Double-encoded path traversal bypass
- flapi-2c5: P1 - azure:// scheme not recognized as remote
- flapi-bax: P1 - Case-sensitive scheme handling mismatch
- flapi-0po: P1 - Symlink escape vulnerability
- flapi-b33: P2 - Unstable DuckDB internal APIs
- flapi-p9h: P2 - Dangling pointer risk
- flapi-96u: P3 - No file size limits in ReadFile
- flapi-bpi: P3 - FileExists swallows exceptions

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: jrosskopf