docs: add agent behavior documentation — explain each agent's analysis scope and output format

[charannyk06]

Priority: P3 — Low

Problem

ChainReview has 5 specialized agents (Architecture, Security, Bugs, Validator, Explainer) but their behavior, analysis scope, system prompts, and output formats are only discoverable by reading the source code. Contributors can't understand or extend agent behavior without deep code exploration.

Solution

Create docs/agents.md covering each agent:

Template per agent:

## Security Agent

**Purpose:** Identifies security vulnerabilities, authentication flaws, injection risks, and data exposure issues.

**Input:** File tree, code snippets, call graph, semgrep results

**Analysis Scope:**
- OWASP Top 10 vulnerability patterns
- Secret/credential exposure
- Injection (SQL, command, prompt)
- Insecure dependencies
- Authentication/authorization flaws

**Output Format:**
Each finding includes:
- `title`: Short vulnerability name
- `severity`: critical|high|medium|low|info
- `category`: OWASP category
- `evidence`: { file, lineStart, lineEnd, snippet }
- `patch`: Optional code fix (validated by Validator Agent)

**Example Finding:**
\`\`\`json
{
  "title": "SQL Injection via unsanitized user input",
  "severity": "high",
  ...
}
\`\`\`

**False Positive Guidance:**
Common cases where Security Agent over-reports...

Also document:

• How agents share information (via orchestrator context)
• How to modify agent prompts (with examples)
• How to add a new custom agent
• Agent model selection (which model is used, why)

Acceptance Criteria

• docs/agents.md documents all 5 agents
• Each agent has: purpose, scope, output format, example
• Guide for modifying agent prompts
• Guide for adding a custom agent
• Linked from README.md