fix(agent): allow ZWJ emoji sequences in threat scanner (#59492)

[webtecnica]

Summary

U+200D (zero-width joiner) in INVISIBLE_CHARS was causing false positives for legitimate emoji ZWJ sequences (e.g. ZWJ emoji sequences) in SOUL.md / AGENTS.md context files. This PR makes the threat scanner context-aware for ZWJ: it only flags U+200D when it does not join two Extended_Pictographic (emoji) characters.

Root cause

tools/threat_patterns.py lists U+200D in INVISIBLE_CHARS, and scan_for_threats() flags any occurrence via set-intersection. The set-based approach loses position information, so legitimate ZWJ emoji sequences are indistinguishable from ZWJ-based injection tactics.

Fix

1. Add _is_extended_pictographic() helper that checks unicodedata.category() == "So" plus Variation Selectors (U+FE00-U+FE0F) and Regional Indicators (U+1F1E6-U+1F1FF).
2. In scan_for_threats(): skip U+200D in the fast set-based intersection, then run a second pass that examines each ZWJ occurrence in context. ZWJ between two emoji => skip (legitimate sequence); ZWJ anywhere else => flag as before.

Changes

File	Change
tools/threat_patterns.py	Add _is_extended_pictographic() + context-aware ZWJ scanning
tests/tools/test_threat_patterns.py	6 new tests for ZWJ emoji false-positive fix

Closes #59492

[alt-glitch]

This was generated by AI during triage.

Duplicate of #59503 — both make scan_for_threats() in tools/threat_patterns.py context-aware for U+200D (skip the finding only when the ZWJ joins two Extended_Pictographic codepoints). #59503 is the earliest open variant of this same-mechanism fix; the extra helper/tests here don't change the underlying change. Also related to the broader #12673 and issue #59492.

[webtecnica]

Closing as duplicate — the sweeper identified this as already covered by another PR. Thanks for the contribution!