Epic: Collapse to CLI — remove MCP + Agno, make scanning agent-invocable

[msoedov]

Collapse the integration surface to a single CLI. Remove MCP and Agno, make scanning directly invocable by coding agents (Claude, Codex) without a running server.

Why

The MCP server is a thin httpx proxy over the FastAPI server — every MCP tool just POSTs to :8718. Running MCP therefore means two processes (MCP stdio + web server) plus the auth/security surface of an exposed server. A local CLI call has none of that.

MCP and Agno are internal/experimental, never a public contract → hard-delete, bump version, no shims.

Phases

• Phase 1: Delete Agno (dead code) #307 — Phase 1: Delete Agno (dead code)
• Phase 2: Delete MCP server + client #308 — Phase 2: Delete MCP
• Phase 3: Add stateless scan CLI command (agent-invocable) #309 — Phase 3: Make the CLI agent-invocable (new stateless scan command)
• Phase 4 — Server stays as the interactive web UI, but is no longer the agent integration path (default bind already 127.0.0.1); no code work tracked separately

Success criteria

• An agent runs a full scan with one CLI command — no server, no agesec.toml on disk — and parses results from stdout.
• grep -ri "mcp\|agno" agentic_security/ returns nothing in source.
• Existing fuzzer/probe tests still pass.

Spec: docs/specs/collapse-to-cli.md