feat: per-subnet scan profiles (P2-05 / 26.15) — closes P2 batch

[CryptoJones]

Summary

Operators can now run aggressive hourly deep scans on critical infrastructure while leaving the guest network on a lazy daily liveness sweep — all from one config, one agent process.

```json
{
"scanner": {
"profiles": [
{ "subnet": "10.0.0.0/24", "scan_interval": "1h", "deep_probe": true },
{ "subnet": "192.168.1.0/24", "scan_interval": "24h" }
],
"scan_interval": "5m",
"timeout": "2s",
"workers": 50
}
}
```

Existing `scanner.subnets` flat-list deployments keep working — mutually exclusive with `profiles`, validated at boot.

Architecture

• `config.SubnetProfile` with `*bool` fields so a profile can explicitly disable a globally-enabled flag (zero-value bools would be ambiguous).
• `config.ScannerConfig.Resolve()` flattens `Subnets` + `Profiles` into `[]ResolvedProfile` with every field populated. Agent's runtime path has zero fallback logic.
• `scanner.Scan(ctx, subnet) → Scan(ctx, subnet, SubnetOptions)`. Scanner-level fields stay as defaults consulted by an internal `resolve()` at the top of Scan.
• Agent ticks at the shortest per-profile interval. Each profile keeps its own `nextDue` timestamp; only due profiles run on each tick. Housekeeping (prune, change-detect diff, tracker) runs every tick regardless, so zero-profile / watchdog-only deployments still work.
• Tick safety floor of 1s prevents `"1ns"` typos from CPU-pegging.

Breaking changes (in-tree only)

• `agent.New(...)` now returns `(*Agent, error)` — `Resolve()` runs at construction so duplicate-subnet / mutually-exclusive errors surface at boot.
• `scanner.Scan(ctx, subnet)` now `Scan(ctx, subnet, scanner.SubnetOptions{})`. Out-of-tree callers pass `SubnetOptions{}` to retain pre-26.15 behaviour.

Test plan

• `go test -race -timeout 120s ./...` clean across all packages
• `golangci-lint run ./...` → 0 issues
• 7 new config tests cover override semantics, pointer-bool `False()` beating global `True`, mutual exclusion, duplicate rejection, empty-profile rejection, zero-profile happy path
• Existing scanner + agent suites updated to the new API surface

Closes the P2 operator-feedback batch

All five items shipped across 26.11–26.15:

Sprint	Item
26.11	Device-type classifier
26.12	Service / app discovery
26.13	Change detection + webhook/syslog alerts
26.14	Query API beyond bulk export
26.15	Per-subnet scan profiles

🤖 Generated with Claude Code