@AGENTS.md Before you commit, run the security-reviewer agent from .claude/agents/security-reviewer.md on the change.