feat: add stateless JSONL scan command

[JackSpiece]

What this adds

• Adds agentic_security scan --spec PATH|- --dataset NAME for one-shot scans without the web server or a config file.
• Streams ScanResult objects as JSON Lines on stdout and keeps diagnostics on stderr.
• Returns exit code 0 within the threshold, 1 for findings over the threshold, and 2 for invalid input or runtime failure.
• Makes CSV artifacts opt-in through --artifacts-dir while preserving the existing server and ci behavior.
• Accepts one dataset name or a comma-separated list and rejects the server-backed AgenticBackend path.

Design note

This is a draft while the required --dataset choice is confirmed in #309. I made it explicit because the registry default is AgenticBackend, which needs port 8718 and would violate the no-server goal.

Verification

• 408 passed, 5 skipped, 41 deselected
• Black, Flake8, mypy, and codespell pass on the changed files.
• A real one-prompt subprocess smoke test produced only valid JSON Lines on stdout, returned 1 for an over-threshold result, emitted one completion event, and created no config or CSV artifact files.

Tracks #309 and is part of #306.

[msoedov]

I would rather avoid these repeated imports, let me pull it locally on the weekend to see if I can fix it.

[msoedov]

Hi @JackSpiece thank you a lot for the patch! Let's merge it as is if you are finished, and I'll fix imports before the release. Just let me know if there is anything else you would like to add