docs: add agent guidance and threat model

[smoelius]

Add AGENTS.md with repository-specific guidance for coding agents, including the
project layout, build and test workflows, change discipline, and standards for
security analysis and reproduction.

Add THREAT_MODEL.md to document validator.js's security boundaries, expected
properties, threat scenarios, possible controls, and non-binding guidance for
reviewing and classifying findings. The threat model also clarifies the
responsibilities retained by applications integrating validator.js.

This PR changes documentation only; it does not alter the public API, runtime
behavior, generated distributions, or package contents.

References used to describe the project and its security and release boundaries:

• README.md
• SECURITY.md
• package.json
• npm publication workflow
• ECMAScript specification

Checklist

• PR contains only changes related; no stray files, etc.
• README updated (where applicable)
• Tests written (where applicable)
• References provided in PR (where applicable)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (cca32d6) to head (f6f1b58).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2828   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2600      2600           
  Branches       659       659           
=========================================
  Hits          2600      2600           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[tux-tn]

Overall, this is a useful addition, especially as we receive more AI-assisted contributions. I also added a suggestion regarding the Node.js guidance

[tux-tn]

Could we make this guidance more generic and avoid hard-coding the CI matrix and future maintenance?
For example:

Suggested change

	- Prefer Node.js 24 for local work. CI also tests Node.js 8, 10, 12, 14, 16, 18, 20, and 22, so avoid syntax or runtime APIs unsupported by the intended compatibility range.
	- Prefer the latest Node.js LTS release for local development. When adding syntax or runtime APIs, follow the compatibility range declared in `package.json` and verify compatibility with the Node.js versions supported by CI.

This keeps the guidance current as the supported Node.js versions and CI matrix change.