refactor: relocate agent-system/ to .agents/ with 7-role workflow restructure

Moves the agent workflow system from agent-system/ to .agents/ (dotfile convention).
Restructured from 5-role to 7-role pipeline: adds Analyst and splits Reviewer into
Code Reviewer + Security Reviewer. Removes all old workflow run artifacts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.agents/prompts/finalizer.md

@@ -0,0 +1,18 @@
+# Finalizer Prompt Baseline
+
+Goal:
+- finalize only when all three reviews pass and quality gates are green
+
+Input:
+- `execution-report.json`
+- `review-code.json`
+- `review-security.json`
+- `review-acceptance.json`
+
+Output:
+- valid JSON by `.agents/contracts/finalizer.schema.json`
+
+Rules:
+- do not finalize if any reviewer verdict is `fail`
+- do not finalize unless `code_review=pass`, `security_review=pass`, `acceptance_review=pass`, and `ci_status=pass`
+- set `final_action` to `hold` and populate `hold_reason` whenever action is `hold`