docs(discovery): decide read-only local discovery

[limaronaldo]

Summary

• decide a hybrid local discovery contract: exact versioned default config paths plus explicit bounded roots
• require --no-default-paths, visible disclosure, no implicit home-directory crawling, and no automatic scan
• define filesystem boundaries, deterministic v1 resource budgets, fail-closed parsing, secret-safe diagnostics, and zero network/process/shell/environment expansion
• keep discovery separate from ScanTarget, ScanReport, existing scan outputs, policy, findings, and attestation
• define a separate versioned discovery envelope, identity/deduplication rules, staged implementation gates, and adversarial acceptance criteria

Decision review

A full architecture council selected the hybrid option with high confidence.
The preserved dissent is that default config reads remain implicit filesystem
access; if disclosure and --no-default-paths cannot remain mandatory,
defaults must become opt-in or discovery must be deferred. The
privacy/security veto agreed with the constrained decision.

Scope

Docs only. This PR does not implement agentshield discover, add a public Rust
API, alter scan behavior, or enumerate third-party client paths without current
upstream documentation.

Validation

• git diff --check
• full multi-perspective architecture review and privacy/security veto

[limaronaldo]

Architecture re-review verdict: no blocking findings. The persisted ADR was reviewed through privacy and implementation lenses. Before this verdict it was corrected to: (1) make discovery method provenance rather than source identity so deduplication is coherent; (2) define explicit-root and effective-profile boundaries; (3) redact absolute paths in console and JSON; (4) discard command, args, env, and unknown fields through an allowlist; (5) define handle-relative no-follow/reparse-point opening with fail-closed unsupported_filesystem_safety and no check-then-open fallback; and (6) add exact adversarial acceptance tests. Validation: git diff --check passes. Scope remains one docs-only ADR; SESSION_HANDOFF_2026-07-23.md is untracked and excluded.