Build agent preflight security gate

[K14-coder]

What changed

Turns agent-preflight into a local-first security gate for agent guidance, MCP configs, scripts, package manifests, and GitHub Actions.

• Adds 12 stable rules with severity, remediation, scoped discovery, and inline reviewed suppressions.
• Adds changed-files mode, severity policies, JSON output, SARIF output, and GitHub Action outputs.
• Adds the composite GitHub Action, unsafe/safe fixtures, issue templates, changelog, and product-focused documentation.

Validation

• npm test
• npm run lint
• SARIF generation against the unsafe fixture
• Git changed-files regression test
• Clean self-scan at the critical policy

Release note

After merge, create the v0.2.0 tag before directing users to the GitHub Action example.