fix: calibrate agent precision benchmark gate

[hlinor-systems]

What changed

• preserve dynamic model declaration signals without emitting code-like model values
• reject primitive and dotted identifier values from agent names
• ignore Dependabot configuration and GitHub Actions workflow metadata
• add regression coverage for MCP policy scope, self-report idempotence, owner punctuation, workflow jobs, and permission locality
• add a pinned six-repository benchmark with scheduled and manual GitHub Actions coverage
• calibrate benchmark bounds from the latest pinned snapshot counts with approximately 40% slack

Why

The scanner had moved between under-detection and noisy inventory as declaration heuristics were tightened. This change separates candidate signals from reportable metadata, narrows non-agent configuration sources, and makes the external regression gate tolerant to small heuristic changes.

Validation

• go test ./...
• go vet ./...
• go test -race ./internal/scan ./cmd/agentctl-benchmark
• demo SARIF regeneration and fixture checks
• staged pre-commit secret and agentctl gates
• pinned external benchmark: 6/6 passing, zero source ACP-005 and zero code-expression metadata hits