Pin minimum lychee version to keep code-block URLs excluded

[rubambiza]

Describe the bug

Following @esnible's report in rossoctl/cortex#533 that a URL inside a backtick/code section was flagged, we confirmed that current lychee excludes URLs inside inline code spans and fenced code blocks by default (verified in the scanner's runtime environment). So code-block URLs are already excluded today.

However, the setup docs (docs/running-without-openclaw.md) install lychee with an unpinned brew install lychee and there is no documented minimum version. lychee's verbatim/code-block handling is version-dependent (--include-verbatim opts URLs back in), so an upgrade or a differently-configured environment could reintroduce the code-block false positives.

Proposed fix

1. Document a minimum lychee version whose default excludes verbatim (code-block) URLs, and pin it in the install step in docs/running-without-openclaw.md.
2. Optionally add a short note in the scanner/skill that the scanner relies on lychee's default code-block exclusion (i.e. must not pass --include-verbatim).

Additional context

• Reported by @esnible via 🐛 Broken link in authbridge/demos/github-issue/demo-aiac.md: http://keycloak-service.keycloak.svc:8080/realms/ cortex#533.
• Companion issue tracks the bare-.svc suppression fix.
• The same scanner logic is mirrored in kagenti/agent-skills; a companion issue tracks this there.

[rubambiza]

Mirror: rossoctl/agent-skills#24 tracks the same change in the agent-skills copy.