CI guard: block new platform/agents/ folders outside the Tier-0 allowlist

[serge-ivo]

Follow-up to the "agents live outside the monorepo" epic.

We just removed 10 standalone-worker agent copies that had accreted under platform/agents/. Nothing prevents them growing back — a future scaffold/copy/paste can silently re-add a folder that is never built or deployed from the monorepo, recreating the drift.

Ask

Add a lightweight CI check (in ci.yml) that fails if any directory appears under platform/agents/ that is not on an allowlist.

• Allowlist = the Tier-0 / platform-integrated agents only: coder, job-application-assistant, repo-chat (per docs/agent-platform-strategy.md).
• Message should point the author at the rule: standalone-worker agents live in their own ProAgentStore/<slug> repo, not the monorepo.
• Keep it a pure directory-listing check (no deps); ~10 lines of shell.

Acceptance

• Adding a stray platform/agents/foo/ makes CI red with a clear message.
• The three allowlisted dirs pass.
• Allowlist lives next to the check with a comment linking the strategy doc.