feat: add safe BLE discovery and network baseline tools

AGENTS.md

@@ -6,7 +6,8 @@ evidence.
 
 ## Non-negotiable safety boundaries
 
-- Default to passive or read-only operations.
+- Default to non-mutating discovery or read-only operations. CoreBluetooth BLE
+  scanning on macOS is active discovery, not passive radio sniffing.
 - Do not send BLE writes until the exact service, characteristic, framing,
   payload semantics, rollback, and expected state transition are documented.
 - BLE notification subscription may perform the standard temporary CCCD write;