Add P3b-4 agent diagnostics

[lantisprime]

Summary

• add bounded deterministic agent diagnostics helpers
• surface user/project registry, trust, hash, scanner, eval, and root-mismatch status
• implement /agents list, built-ins, config, inspect, registry, verify, and doctor diagnostic commands
• add session-start proactive project-agent recommendation with per-session dedupe
• add diagnostics and extension scaffold tests

Tests

• agents/test-fixtures/run-p3b-4-tests.sh
• scripts/test-security-scan.mjs
• git diff --check

Coverage

• deterministic/bounded doctor and verify output
• project trust inactive disables project discovery
• project registry root mismatch reported
• unregistered specs reported with next steps
• hash mismatch reported with next steps
• dangerous specs reported
• reserved built-in shadowing reported
• missing eval metadata reported
• registry-only entries reported
• proactive project-agent recommendation dedupes on session_start and re-shows on explicit list

Scope notes

• no registration writes
• no child argv construction
• no child Pi execution
• no run_subagent
• no chain mode
• no --approve usage