fix(audit): close remaining non-Windows findings from 2026-06-01 deep audit

[XuebinMa]

Summary

Closes the HIGH/MEDIUM findings from the 2026-06-01 weekly deep audit (docs/audits/2026-06-01.md) that PR #46 did not cover — #46 only closed the two top security findings in bash.rs (CRITICAL path-traversal + HIGH flag-form write targets). Windows AppContainer findings are tracked separately in #48.

All findings were re-verified as still present in current main before fixing.

Findings addressed

Severity	File	Fix
HIGH	agent-guard-sdk/src/anomaly.rs	report_denial recovers the poisoned state mutex via into_inner() and logs, so a denial is still recorded and the Deny Fuse can trip — previously a poison silently returned, letting an actor exhaust the lock threshold. check now logs on poison for parity.
HIGH	agent-guard-sdk/src/enforce.rs	Surface ledger.decide() failures when marking an expired approval Expired instead of discarding them; AlreadyDecided stays benign.
MEDIUM	agent-guard-sdk/src/enforce.rs	Replace the dead let _ = stderr_present no-op with a debug log so handoff stderr omission is observable.
MEDIUM	agent-guard-sdk/src/content_filter.rs	Warn when a tool payload fails to parse as JSON so a skipped scan is distinguishable from a clean one.
MEDIUM	agent-guard-sdk/src/executors.rs	Extend the SSRF deny-list: RFC 6598 CGNAT (100.64.0.0/10), RFC 2544 benchmark (198.18.0.0/15), 0.0.0.0/8, and 6to4 (2002::/16) embedded-IPv4 unwrapping.
MEDIUM ×2	agent-guard-core/src/decision.rs	Drop Deserialize from GuardDecision so untrusted JSON can't synthesize an Allow; mark DecisionReason #[non_exhaustive] so cross-crate callers go through the constructors that guarantee a non-empty message.

Deferred

Windows AppContainer findings (2 HIGH + 1 MEDIUM, discarded Win32 return values) → tracked in #48. They only compile under the windows-appcontainer feature and need a Windows host to verify.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --exclude agent-guard-python --all-features -- -D warnings
• cargo test --workspace --exclude agent-guard-python --all-features (all pass)
• 6 new SSRF regression tests for the added deny-list ranges (CGNAT / benchmark / 0.0.0.0/8 / 6to4)
• Windows AppContainer findings verified on a Windows host (deferred to Harden Windows AppContainer sandbox: discarded Win32 return values (2026-06-01 audit) #48)