Add Agent dependency advisory and incident scans

[AnthonyRonning]

Agent's imported Cargo workspace had platform build/test coverage but no scheduled RustSec or malicious-crate scan. Add an independent supply-chain lane for its lockfile and all local dependency manifests, using the existing pinned cargo-deny action with read-only permissions and no publication credentials.

The lane runs on dependency/config PRs, matching master pushes, daily, and manual dispatch. It scans all features and preserves the incident denylist; advisory exceptions are not copied from Research, SDK, or proxy. Audit-policy-only edits do not require Agent binary builds. Official Agent release/distribution remains disabled.

Validation:

• nix flake check --no-update-lock-file passed every host check, including actionlint and Agent workflow/classifier security tests.
• Local audit used cargo-deny 0.20.2 (the workflow's pinned version), Agent's pinned Rust environment, locked dependencies, and RustSec DB 8a1eb4f933fb5821add5b4e98601ebd90b8b3538.
• No vulnerability/unsoundness error or incident-denylist hit was reported. The audit correctly failed on the existing unmaintained dependencies below, and warned that chacha20 0.10.1 is yanked. No dependency or lockfile changes and no suppressions are included.

Existing dependency	Finding
atomic-polyfill 1.0.3	RUSTSEC-2023-0089
paste 1.0.15	RUSTSEC-2024-0436
proc-macro-error2 2.0.1	RUSTSEC-2026-0173
rustybuzz 0.20.1	RUSTSEC-2026-0206
ttf-parser 0.25.1	RUSTSEC-2026-0192

These are dependency-maintenance findings, not a demonstrated exploit. This PR intentionally exposes them instead of silently inheriting another component's broad unmaintained-advisory exclusion; resolving them needs a separate dependency/policy review before this strict lane is green.