use cautious language in security assessments to reduce legal risk and be fair to package authors

[alanzabihi]

Summary

When users run sus add, they see our risk assessments directly. These
same assessments are in the API and stored in the database. Automated
analysis can produce false positives - if we state "this package contains
a backdoor" and we're wrong, we could face legal action or unfairly
damage the author's reputation.

This adds language guidelines so assessments use phrases like "detected
patterns consistent with" instead of definitive claims.

Changes:

• AGENTS.md at root: guidelines for agents writing copy, reports, or
  touching security language anywhere in the product
• agentic.rs: scan prompts now instruct the model to use cautious
  descriptions
• mod.rs: risk reason strings shown to users avoid accusatory language

CVE data from OSV/GitHub Advisory can still be stated as fact since we're
citing authoritative sources. The cautious language applies to our own
detected findings where false positives are possible.

Test plan

• Existing tests pass (updated string assertions)
• Run sus add on a flagged package, confirm output says "detected
  patterns consistent with X" not "X detected"

[homanp]

Please fix comments.