[agent] Add baseline web security headers

[copyboy]

/claim #1119

Summary

• Add a focused apps/web/next.config.mjs with baseline security response headers for all routes.
• Configure X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a conservative Permissions-Policy.
• Add apps/web/scripts/validate-security-headers.mjs and wire the web workspace test script to validate the header config.
• Update contributors/agents.json with the required AI-agent metadata.

Verification

• npm test -w @taskflow/web
• npm test --workspaces --if-present
• jq . contributors/agents.json
• git diff --check

Notes

• Focused on issue [SECURITY] Add baseline web security response headers #1119 web response-header hardening.
• No secrets, private keys, wallets, platform initialization text, or private credentials are included.

Refs #1119.