Require direct agent execution in toolbox suites

[csark0812]

Summary

• convert all retained agent-behavior suites to direct Cursor execution
• remove committed replay traces, replay-only ceiling suites, obsolete CLI flags, and stale package patching
• preserve offline suite validation and report comparison while documenting credential requirements and provider usage
• add a durable test that rejects replay fields, replay hosts, and committed replay fixture directories

Depends on post-print/agent-spec#39.

Verification

• npm run test:unit — 98 tests passed
• npm run format:check
• npm run lint
• npm run typecheck
• npm run audit:skills
• npm run audit:deps — 0 production vulnerabilities
• npm run validate:ci
• PR #39 CLI: --validate-only --validate-paths --suites-dir agent-suites — 20 suites, 83 scenarios passed
• residue search for replay host/config/fixtures and removed CLI flags

Validation limit

A full npm run check reaches the hub audit and reports pre-existing review-date drift in unchanged docs/tiers.md. The migration-owned scoped docs audit and post-commit validate:ci pass. No credentialed agent scenarios were run, so this PR does not incur provider usage.