Add bug bounty validation loop

[wryan2986]

What changed

• add a deterministic bug-bounty controller and scoped HTTP wrapper
• add exact-scope authorization manifests and a separate owned local-lab profile
• add isolated discovery, reproduction, blind verification, impact-review, and report-drafting agents
• add /bounty-init and /bounty commands
• add usage, architecture, and false-positive-control documentation
• add deterministic and mocked integration tests

Safety model

• all active requests must go through an exact-origin, path, method, redirect, rate, and response-limited wrapper
• authorization must be explicitly confirmed from the current program policy
• testing is limited to controlled accounts and objects
• real-user data and service instability are hard-stop conditions
• fresh-state reproduction, a negative control, blind independent verification, and concrete impact are mandatory
• any failed or uncertain gate quarantines the candidate
• reports are drafted only; automatic submission is disabled and human review is mandatory

Validation

• cd bug-bounty-loop && npm run validate
• 12 tests passed
• includes a complete mocked OpenCode run that reaches READY_FOR_HUMAN_REVIEW while confirming no report is submitted

Limits of validation

The deterministic controller and wrapper were tested locally. The agent integration test uses a mocked OpenCode executable; this PR has not been run against a real bounty target or submitted to any bounty platform.