[codex] Fix local agent discovery imports

[brandonkachen]

Summary

Fixes local agent discovery so loading .agents no longer imports arbitrary executable JavaScript/TypeScript files during discovery.

Root Cause

The SDK local agent loader recursively imported every JS/TS-like file under .agents except skills/. That meant unrelated executable scripts, including quarantined skill scripts under directories like skills-quarantine, could run top-level side effects while Freebuff or Codebuff was only trying to discover local agents.

Changes

• Skip hidden directories, node_modules, skills, and skills-* during local agent discovery.
• Add a source-level prefilter before dynamic import so files must look like agent definition exports with id or model before being imported.
• Add regression tests proving non-agent scripts and quarantined skill scripts are not imported.

Validation

• bun test sdk/src/__tests__/load-agents.test.ts
• bun run --cwd sdk typecheck
• git diff --check