feat(security): add private run commands and comparison

[leemour]

Add security scan, Socket, agent, and comparison commands over the existing scripts. Runs use private folders with scope, raw output, report, pinned tool versions, exit codes, and observation history. Comparison rejects incomplete or differently scoped evidence and reads legacy audits without edits. Agent runs require explicit live intent, a clean build checkout, caller configuration, a successful blocked-write canary, and separate write-attempt/expected-answer checks; cleanup failures cannot pass.

Validation: lint, typecheck, 51 tests, 100% line and function coverage, docs checks, Bun smoke, shell syntax, and the high severity zizmor gate passed. Synthetic executable tests exercise write refusals, utility failures, runtime propagation, and payload cleanup. The original private audit was read without modification (25 artifacts); no live messenger runs occurred. Package review contains the five needed scripts and excludes tests.