docs: add agent guidance and threat model

[smoelius]

Add AGENTS.md with repository-specific guidance for coding agents, including the
project layout, build and test workflows, change discipline, and standards for
security analysis and reproduction.

Add THREAT_MODEL.md to document validator.js's security boundaries, expected
properties, threat scenarios, possible controls, and non-binding guidance for
reviewing and classifying findings. The threat model also clarifies the
responsibilities retained by applications integrating validator.js.

This PR changes documentation only; it does not alter the public API, runtime
behavior, generated distributions, or package contents.

References used to describe the project and its security and release boundaries:

• README.md
• SECURITY.md
• package.json
• npm publication workflow
• ECMAScript specification

Checklist

• PR contains only changes related; no stray files, etc.
• README updated (where applicable)
• Tests written (where applicable)
• References provided in PR (where applicable)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (cca32d6) to head (bdd0244).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##            master     #2828   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          114       114           
  Lines         2600      2598    -2     
  Branches       659       658    -1     
=========================================
- Hits          2600      2598    -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[tux-tn]

Overall, this is a useful addition, especially as we receive more AI-assisted contributions. I also added a suggestion regarding the Node.js guidance

[smoelius]

@tux-tn Sorry for the delay. I applied your suggestion. Please let me know if there are any additional changes you would like made.

[tux-tn]

Thank you for addressing my suggestion. The rest looks good to me. Let’s see if the other maintainers have any additional feedback.