Add AST-based security middleware and enforcement wiring

tests/config.test.ts

@@ -9,6 +9,8 @@ test("loads defaults and freezes config", () => {
   assert.equal(config.orchestration.maxDepth, 4);
   assert.equal(config.provisioning.portRange.basePort, 36000);
   assert.equal(config.discovery.fileRelativePath, ".agent-context/resources.json");
+  assert.equal(config.security.violationHandling, "hard_abort");
+  assert.equal(config.security.commandTimeoutMs, 120000);
   assert.equal(Object.isFrozen(config), true);
   assert.equal(Object.isFrozen(config.orchestration), true);
 });
@@ -20,3 +22,9 @@ test("validates boolean env values", () => {
   );
 });
 
+test("validates security violation mode", () => {
+  assert.throws(
+    () => loadConfig({ AGENT_SECURITY_VIOLATION_MODE: "retry_forever" }),
+    /invalid_union|Invalid input/i,
+  );
+});