Agent security configuration generator — translates canonical security rules into agent-specific configs