security: harden agent scanner and local commit gates

[hlinor-systems]

What changed

• Preserve all MCP servers from multi-server .mcp.json metadata and apply one deduplicated ACP-005 finding per unapproved server.
• Keep strong agent signals visible under .claude, .github, Markdown files, and library layouts while avoiding generic GitHub workflow false positives.
• Reduce non-production ACP-001 owner gaps to informational severity and harden declaration parsing.
• Add a fail-closed staged-diff secret guard for sensitive filenames, provider patterns, contextual entropy, normalization, symlink/path checks, binary and resource limits.
• Require an interactive local bypass reason, reject bypass in CI/protected branches, verify the agentctl version interface, and publish SARIF atomically with mode 0600.

Why

The review found that MCP metadata findings were bypassed, multi-server configurations lost entries, broad path exclusions hid framework agents, and a single scanner-vocabulary heuristic could hide files. The local hook also needed a staged-only secret layer so it does not rely on one regex or on the full repository scan alone.

Validation

• go test ./...
• go vet ./...
• Python staged-guard unit tests
• bash -n .githooks/pre-commit
• local pre-commit hook and CI/protected-branch bypass checks
• staged secret guard on all 10 committed paths
• git diff --check

The PR remains draft until the GitHub Actions checks complete.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.