fix: input-aware pipeline filtering and release 1.0.3-4

[lightsifter]

Summary

• Fix search-policy: pipeline grep filter only exempt at tail position — 'cmd | grep pat | head' wrongly denied #109 by classifying each piped filter from its own arguments and input source, regardless of pipeline position.
• Allow stdin-only filtering before head, wc, sort, or other downstream commands; deny file operands, recursive searches, file-backed patterns, and input redirection.
• Regenerate native hooks and OMP artifacts; synchronize documentation and release metadata for 1.0.3-4.

Verification

• bun run check: passed.
• bun run check:local: 532 passed, 3 skipped, 0 failed; 4018 assertions; Node smoke and benchmark checks passed.
• bun run pack:check: npm 11.15.0 publish dry-run passed.
• Five issue acceptance cases verified against the real generated Node hook.
• A first release-validation run observed an intermittent existing 900-file concept batching test failure; the isolated file and complete suite rerun passed without code or gate changes.
• Private regression tests remain in the repository's existing ignored local test directory; public CI runs the checked-in gates.

Closes #109.