Dogfood Agent Code Guard against its own repository in CI

[stef-k]

Summary

• reject any LOC ratchet baseline in Agent Code Guard's own repository
• run the installed \code-guard . --ci\ command over the real checkout on Windows, Ubuntu, and macOS
• keep REVIEW findings visible and non-blocking while FAIL and tool errors block CI
• preserve existing package smoke, parser, unit, compile, and compatibility coverage

Validation

• zero-baseline normal audit: REVIEW, exit 1, no FAIL
• zero-baseline CI audit: same visible findings, exit 0
• baseline-presence rejection: exact stderr, exit 1
• full suite: 298 passed
• workflow YAML and parsed commands verified
• \git diff --check main...HEAD\

Agent Code Guard intentionally uses no LOC baseline.

Closes #101