docs: add agent guidance and threat model

[smoelius]

Add AGENTS.md with repository-specific guidance for coding agents, including the
project layout, build and test workflows, change discipline, and standards for
security analysis and reproduction.

Add THREAT_MODEL.md to document validator.js's security boundaries, expected
properties, threat scenarios, possible controls, and non-binding guidance for
reviewing and classifying findings. The threat model also clarifies the
responsibilities retained by applications integrating validator.js.

This PR changes documentation only; it does not alter the public API, runtime
behavior, generated distributions, or package contents.

References used to describe the project and its security and release boundaries:

• README.md
• SECURITY.md
• package.json
• npm publication workflow
• ECMAScript specification

Checklist

• PR contains only changes related; no stray files, etc.
• README updated (where applicable)
• Tests written (where applicable)
• References provided in PR (where applicable)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (cca32d6) to head (f6f1b58).

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2828   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2600      2600           
  Branches       659       659           
=========================================
  Hits          2600      2600           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.