feat: add stateless JSONL scan command

[JackSpiece]

What this adds

• Adds agentic_security scan --spec PATH|- --dataset NAME for one-shot scans without the web server or a config file.
• Streams ScanResult objects as JSON Lines on stdout and keeps diagnostics on stderr.
• Returns exit code 0 within the threshold, 1 for findings over the threshold, and 2 for invalid input or runtime failure.
• Makes CSV artifacts opt-in through --artifacts-dir while preserving the existing server and ci behavior.
• Accepts one dataset name or a comma-separated list and rejects the server-backed AgenticBackend path.

Design note

This is a draft while the required --dataset choice is confirmed in #309. I made it explicit because the registry default is AgenticBackend, which needs port 8718 and would violate the no-server goal.

Verification

• 408 passed, 5 skipped, 41 deselected
• Black, Flake8, mypy, and codespell pass on the changed files.
• A real one-prompt subprocess smoke test produced only valid JSON Lines on stdout, returned 1 for an over-threshold result, emitted one completion event, and created no config or CSV artifact files.

Tracks #309 and is part of #306.