fix(skills): catch sed flag variants; exempt content-contract prose in plugin code

Review-fold from the 3-angle simplify pass:

- sed -Ei / -iE / --in-place now match the shell-critical tier (the
  bare '\s-i\b' token missed combined short flags and the GNU long
  form); read-only sed stays unflagged. Regression tests added.
- agent_config_contract joins plugin_guard's CODE_EXEMPT_PATTERN_IDS:
  content-contract prose in plugin code files (docstrings/comments)
  is the same false-positive class the existing agent_config_mod
  exemption suppresses. Doc/config files keep the full pattern set.

Efficiency reviewer: 1.24x full-scan cost (+3.4ms/file, install-time
only), worst-case adversarial line 55us — no ReDoS exposure.

tools/plugin_guard.py

@@ -94,6 +94,7 @@ CODE_EXEMPT_PATTERN_IDS = {
     # Plugins legitimately write their own settings into config.yaml during
     # post_setup, and encode credentials (e.g. HTTP Basic auth) with base64.
     "agent_config_mod",
+    "agent_config_contract",
     "encoded_exfil",
 }