deepsec AI vulnerability scan

Vercel Labs deepsec: regex candidate scan followed by an AI agent review of the riskiest files (or of changed files with settings diff). Opt-in: run with --only agent.deepsec. Costs real money (default cap about $5, enforced between chunks) and the review agent gets a sandboxed shell in the target, so only run it on code you trust. State goes to a temp directory, not the target.