feat: add --changed fast mode to maintenance agents restricting scope to git-modified files under devplacepy/ and tests/

Implement a new `--changed` flag for the maintenance agent fleet that limits checking and fixing to only files git reports as modified or new (untracked) under `devplacepy/` and `tests/`. The change introduces `agents/changed.py` with `changed_paths()` parsing `git status --porcelain`, adds `_WRITE_ALLOWLIST` guard logic in `agents/agent.py` (`set_write_allowlist`, `clear_write_allowlist`, `_allowlist_guard`) wired into `_mutation_guard` and `create_file`, threads the file list through `orchestrator.run_fleet` -> `agent.run` -> `_execute` -> `task_prompt` with a dedicated "CHANGED-FILES RUN" prompt branch, and exposes `make maintenance` (read-only) and `make maintenance-fix` (fix mode) targets in the Makefile. Documentation is updated in `AGENTS.md`, `CLAUDE.md`, and `README.md`.

Makefile

@@ -137,13 +137,15 @@ validate:
 #   make audit-agent CHECK=1   # report only
 #   make agents-all            # run the whole fleet
 #   make maestro               # talk to the conductor; it runs the rest
+#   make maintenance          # whole fleet, concurrent read-only, only git-changed files
+#   make maintenance-fix      # whole fleet, fix mode, only git-changed files
 # ---------------------------------------------------------------------------
 CHECK ?=
 AGENT_MODE := $(if $(CHECK),--check,--fix)
 
 .PHONY: security-agent audit-agent devii-agent docs-agent fanout-agent \
         dry-agent style-agent frontend-agent seo-agent test-agent \
-        agents-all maestro
+        agents-all maestro maintenance maintenance-fix
 
 security-agent:
 	python -m agents.security $(AGENT_MODE)
@@ -180,3 +182,9 @@ agents-all:
 
 maestro:
 	python -m agents.maestro
+
+maintenance:
+	python -m agents.orchestrator --check --changed
+
+maintenance-fix:
+	python -m agents.orchestrator --fix --changed