feat: add incremental scan baselines

[hlinor-systems]

What changed

• Add root and subcommand help for the supported agentctl CLI surface.
• Add JSON baseline filtering by stable finding ID for incremental CI gates.
• Replace the working-directory-only output restriction with an explicit output-path policy.
• Reject final output symlinks and write reports atomically with mode 0600.
• Add regression coverage and document the new workflow.

Why

CI needs to distinguish newly introduced findings from findings already accepted in a reviewed baseline. Report output also needs a predictable, explicit, and private file policy for local and CI use.

Validation

• go test ./...
• go vet ./...
• git diff --check
• Real CLI run with an absolute output path, threshold failure, and symlink rejection.
• Local staged secret guard passed.

Scope

This change does not alter scanner rule semantics or execute scanned content. It remains read-only and metadata-only.