feat: add differential agent security release gate

[Auro-rium]

What changed

Agent Canary now has a production-oriented CUTC release gate layered on the existing LangGraph red-team engine.

• Adds accepted environment-specific baselines and stable reusable attack cases.
• Replays baseline payloads against candidates and classifies regressions as regression, known, resolved, clean, or indeterminate.
• Adds explicit PASS/WARN/BLOCK policy evaluation, scores, coverage, and persisted evidence.
• Adds project-scoped CI tokens, target SSRF validation, ownership verification, and release lifecycle primitives.
• Updates the GitHub Action with job summaries and release metrics.
• Adds release evidence components and project/release baseline UX.
• Rewrites README and technical architecture documentation.

Validation

• uv run pytest -q — 178 passed, 3 warnings
• npm run build — passed
• npm run lint — passed with two pre-existing Fast Refresh warnings
• Targeted Ruff checks — passed

Limitations

Local execution remains SQLite plus an API process thread; PostgreSQL/Redis worker deployment is documented as the next production adapter. The Vercel dashboard proxy remains read-only for administrative operations.