Add AG033: irreversible data destruction exposed to the agent (0.15.0)

[autonomyproof]

Detects an agent tool that can wipe an entire datastore or directory tree with no approval step — the 'agent deleted the whole database' failure class.

Why it's distinct from AG019 (destructive string) and generic SAST:

• Call-based: catches db.drop_all(), redis.flushall(), shutil.rmtree() — which carry no SQL/string literal and so are invisible to string- or grep-based detection.
• Agent-context scoped: fires only inside a registered tool function with no approval marker, which is what keeps it zero-false-positive.
• Excludes the overloaded bare .drop( (pandas df.drop(columns=...)) by design.

Sinks: drop_all, drop_database, drop_collection, flushall/flushdb, shutil.rmtree, os.removedirs, and embedded DROP DATABASE / DROP TABLE / TRUNCATE TABLE. Mapped to MITRE ATT&CK T1485 (Data Destruction) + T1561 (Disk Wipe).

Verification:

• Ground-truth corpus: 127 cases, precision 1.000 / recall 1.000 (adds 7 AG033 cases incl. pandas-drop, non-tool, and approval-gated negatives).
• Real-repo benchmark: 0 findings across all 41 repos (frameworks register no such tool) — zero false positives, as expected; recall proven by the corpus.
• 530 tests pass, 100% branch coverage, ruff + mypy clean.

Bumps version 0.14.0 -> 0.15.0; adds CHANGELOG.md.