chore: add AgentScan workflow

[splincode]

Summary

• add AgentScan for new and reopened pull requests
• skip repository owners, members, and collaborators
• keep automatic closing and honeypot behavior disabled
• pin the AgentScan action to a commit SHA
• use least-privilege permissions for AgentScan
• disable persisted checkout credentials in the regular build workflow

AgentScan analyzes contributor activity for automation signals and can help triage low-quality automated pull requests without executing pull request code.

References:

• https://agentscan.tools/
• Integrate AgentScan prettier/prettier#20111