A prompt injection in a GitHub issue title let an outsider poison Cline's CI cache and steal release tokens. What is documented, and what is not.