feat(ci): add agent tests validation gate to release process

[8nevil8]

Summary

Adds an unconditional agent test validation gate to scripts/release.sh that runs before tagging. The gate blocks the release if agent tests fail, continues automatically if they pass, and requires explicit manual confirmation if tests cannot run due to missing SSO/JWT credentials — the release never silently skips test validation.

Closes EPMCDME-13925

Changes

• scripts/release.sh: 48-line gate block added between the version-bump commit and tag creation. Runs npm run test:integration:agent with --reporter=json --outputFile to capture structured results, parses numPassedTests via node -e, and branches on three outcomes:
  • exit non-zero → ❌ Agent tests FAILED + exit 1
  • exit 0 + numPassedTests > 0 → ✅ Agent tests passed + continues
  • exit 0 + numPassedTests == 0 (SSO/JWT unavailable) → explanation block + read -p manual confirmation
• mktemp guarded with || { echo "ERROR: mktemp failed"; exit 1; } to prevent silent misclassification if /tmp is unavailable
• trap 'rm -f "$AGENT_TEST_JSON"' EXIT INT TERM added to clean up the temp file on signal kill during the multi-minute test run
• Header comment updated to document the release flow

Testing

• Tests added/updated — N/A (bash script; verified via plan's manual scenarios)
• Manual testing done — three outcome branches reviewed in code review; all 6 acceptance criteria confirmed satisfied

Checklist

• Code follows project standards
• CI is green (npm run ci — 181 unit files, 30 integration files, lint, typecheck, build, commitlint all pass locally)
• No merge conflicts with main