fix(ci): install prettier via mise; ignore agent tooling output

[aguil]

Two independent repo-hygiene fixes, one commit each.

1. Prettier CI flake (acd19051)

The pre-commit prettier hook ran npm exec --yes --package prettier@3.8.1,
reinstalling prettier into ~/.npm/_npx on every invocation. Nothing caches
that directory, so CI refetched it each run and the install intermittently raced
itself:

npm error ENOTEMPTY: directory not empty, rename
  .../node_modules/prettier -> .../node_modules/.prettier-rObPqhmw

and on another run, a half-written module:

node_modules/prettier/internal/legacy-cli.mjs:3630
SyntaxError: Unexpected end of input

This failed 2 of 4 runs on #125 and passed on re-run each time — pure
infrastructure noise, unrelated to the content being checked.

prettier now comes from .mise.toml like every other QA tool, and the hook uses
mise exec --locked, matching the sibling stylua hook. mise-action already
runs with install: true / cache: true, so the install is provisioned once and
cached instead of refetched per run.

Verified:

• Formatting is byte-identical to the old npx path, checked against a
  deliberately mangled file both with and without the repo's .prettierrc.json
  (printWidth: 80, proseWrap: "always").
• Works under the exact CI environment (MISE_EXPERIMENTAL=0, MISE_PARANOID=1,
  MISE_TRUSTED_CONFIG_PATHS) — the npm backend does not require experimental
  mode.
• Forced clean reinstall (mise install prettier@3.8.1 --force) succeeds with
  experimental off.
• 4 consecutive green CI runs on this branch (1 initial + 3 re-runs),
  vs 2 failures in 4 runs on the old path. First run 41s while mise installed
  prettier fresh; 10-12s thereafter on a warm mise cache. CI logs confirm
  prettier resolving from ~/.local/share/mise/installs/prettier/3.8.1/
  with no _npx involvement.

One caveat worth knowing: mise's npm backend records only the version in
mise.lock, not a checksum, so --locked pins what version runs but not a
hash. The old npm exec --yes gave no hash either, so this is not a regression —
but it is weaker than the aqua-backed tools.

2. Ignore agent tooling output (7b6c6581)

agents code-review / agents triage write .agents-code-review/ and
.agents-triage/ into the repo root. These were only being kept out of commits
by a machine-local ~/.gitignore_global, so a fresh clone would see them as
untracked and could commit them by accident. The run directories contain full
context bundles of the working tree.

Added .agents-*/ so future agents subcommands are covered without another
edit. Verified with git check-ignore against an empty global excludes file;
dot_agents/ is unaffected and nothing tracked matches the pattern.

Gates

pre-commit --all-files, both Neovim suites, qa.just verify-shell
(23 unit + 4 integration), and qa.just verify-nvim-lua all pass locally.