Part of #1195 — Phase 5

Surface injection detection events in CLI mode (non-TUI).

Crates: zeph-core, zeph-channels
Depends on: SEC-1.4

Tasks:

• CLI channel: print [SECURITY] prefixed warning when injection pattern detected in tool result
• --verbose flag: show full sanitization details (source, patterns matched, content truncated)
• CLI subcommand zeph security-log to dump recent security events from SQLite
• Unit tests for CLI output formatting

Files: crates/zeph-channels/src/cli.rs, src/main.rs