Add agent security scan workflow

[luckyPipewrench]

Adds a GitHub Actions workflow that scans PRs for security risks using Pipelock.

What it checks:

• Exposed credentials, API keys, and tokens in diffs
• Prompt injection patterns
• Common security issues in MCP projects

How it works:

• Runs on every PR to main
• Read-only permissions (contents: read)
• Fails the check if it finds something
• No configuration needed

Single workflow file, no changes to existing code or CI. Complements the existing CI workflow with security scanning.