Workspace Sweep: scan what your agent will read, and what the last session left behind

Pre-session hook that flags planted instructions and tampered agent artifacts before coding agents read them; developers subscribe.