Add P3b-2 agent Markdown scanner

[lantisprime]

Summary

• add bounded Markdown/frontmatter parsing for user/project agent specs
• add raw-file-byte SHA-256 helper and deterministic directory scanning
• vendor the shared deterministic security scanner into agents/lib/security-scan.ts
• classify safe/suspicious/dangerous specs and block dangerous eligibility
• detect reserved built-in name shadowing
• update shared scanner sync/verify scripts to include agents

Tests

• agents/test-fixtures/run-p3b-2-tests.sh
• scripts/test-security-scan.mjs
• git diff --check

Coverage notes

• parser cap tests for file/frontmatter/prompt limits
• invalid name/tool/thinking tests
• raw hash change test
• dangerous scanner blocking, including malformed dangerous specs
• reserved-name shadow detection
• deterministic directory scans and .md directory skip
• shared scanner sync verification

Scope notes

• no registry writes
• no child Pi execution
• no run_subagent
• no chain mode