fix(security): resolve 5 CodeQL alerts, document FPs, harden deploy skills

Real fixes (alerts auto-close on next scan):
- agentSkills/generator: escape backslash before double-quote in YAML
  frontmatter so a trailing backslash can't escape the closing quote
  (js/incomplete-sanitization #297/#298)
- usage: replace /\s*\(RESTRICTED\)\s*$/ with a non-backtracking literal +
  trim (js/polynomial-redos #275)
- i18n/request: skip __proto__/constructor/prototype in deepMergeFallback
  (js/prototype-pollution-utility #274)
- scripts/ad-hoc/nvidia diag: log key presence only, never key chars
  (js/clear-text-logging #273)
- tests: regression coverage for all three production fixes (YAML round-trip,
  proto-pollution guard, RESTRICTED strip + ReDoS timing)

Docs:
- ARCHITECTURE.md: executor count 45->55, OAuth modules 15->16, agy.ts in list

Deploy skills (deploy-vps-*-cc/-cx/-ag): add --legacy-peer-deps (npm v11
peer-dep resolver crashes on the omniroute tree) and replace the
"; pm2 start" that masked a failed install with a proper && chain.

scripts/ad-hoc/nvidia-startswith-diag.ts

@@ -166,7 +166,8 @@ async function partC() {
 async function main() {
   line("");
   line("NVIDIA NIM — diagnóstico `startsWith is not a function`");
-  show("NVIDIA_API_KEY presente", KEY ? `sim (${KEY.slice(0, 6)}…)` : "não");
+  // Never echo any portion of the key (js/clear-text-logging) — presence only.
+  show("NVIDIA_API_KEY presente", KEY ? "sim" : "não");
   show("BASE_URL", BASE_URL);
   show("MODEL", MODEL);
   line("");