fix(agent-guard): guard_dirs() fails to discover contributed skill guards under plugins/*/skills/*/guards #1756

What's broken

Following the modular plugin extraction (#1087, #1672), skill definitions and their guards were relocated to modular plugin subtrees (e.g. plugins/magpie-pr-management/skills/pr-triage/guards/ and plugins/magpie-security/skills/issue-fix/guards/).

However, agent_guard.guard_dirs() (tools/agent-guard/src/agent_guard/__init__.py:1636) only scans (root / "skills").glob("*/guards"). It fails to discover contributed guards under plugins/*/skills/*/guards, silently dropping domain safety guards (mention.py, mark_ready.py, security_language.py) during pre-execution validation.

Which layer

• tools/agent-guard/src/agent_guard/__init__.py
• tools/agent-guard/tests/test_skill_guards.py
• tools/agent-guard/tests/test_discovery.py

How to reproduce

Run in Python within the repository:

import agent_guard
guards = agent_guard.discover_guards()
print(f"Discovered {len(guards)} guards:")
for fn, triggers in guards:
    print(f" - {fn.__name__} {triggers}")

Observed output:

Discovered 1 guards:
 - guard {'git:commit'}  # only no_verify_commit.py from guards.d

Expected vs actual

• Expected: All 4 guards (no_verify_commit, mention, mark_ready, security_language) are discovered and loaded.
• Actual: Only no_verify_commit.py is discovered. Furthermore, tools/agent-guard/tests/test_skill_guards.py:31-32 hardcodes legacy non-existent paths (skills/pr-management-triage and skills/security-issue-fix), asserting against stale locations.

Surface area (optional)

Affects all supported agent harnesses utilizing agent-guard (Claude Code, Codex, OpenCode, Kiro, Gemini, Grok, Junie) where contributed guards are expected to enforce author-only mention policies and embargo safety rules.

Environment (optional)

Any adopter tree deploying Magpie modular plugins or checkout environments where skills/* symlinks are not traversed.