Add P3b-5 agent registration flows

[lantisprime]

Summary

• add registration helpers for /agents register, register-project, and unregister
• require interactive confirmation before durable registry writes
• fail closed in non-TUI/no-UI paths
• block invalid, dangerous, and reserved-name-shadowed specs before confirmation
• require per-spec confirmation for suspicious specs
• support register-project --all-safe for safe specs only
• block project registration when project trust is inactive or the project registry root mismatches
• wire registration commands into /agents and add focused tests

Tests

• agents/test-fixtures/run-p3b-5-tests.sh
• scripts/test-security-scan.mjs
• git diff --check

Coverage

• TUI confirmation required before writes
• cancelled confirmation writes no registry entry
• non-TUI writes no registry entry
• dangerous, invalid, and shadowed specs blocked without confirmation
• suspicious excluded from --all-safe
• suspicious can register only via explicit per-spec confirmation
• project trust inactive blocks project registration
• project registry root mismatch blocks project registration
• unregister requires confirmation and does not delete Markdown specs
• diagnostics reflect registered user agents

Scope notes

• no child argv construction
• no child Pi execution
• no run_subagent
• no chain mode
• no --approve usage