feat(extensions): port active agent modules as timmy-sidecar extensions

- Moved 3 actively-used custom agent modules to timmy-config/extensions/
  - shield.py (crisis & jailbreak detection)
  - privacy_filter.py (PII stripping for remote API calls)
  - smart_model_routing.py (cheap vs strong model heuristic)
- Updated deploy.sh to copy extensions/ to ~/.hermes/agent/
- Added comprehensive migration doc in docs/AGENT_EXTENSION_MIGRATION.md
- Archived 16 dead/unused agent/*.py modules to agent/archive/ in hermes-agent

This is SIDECAR-3 — restructure agent/* extensions as sidecar skills.

Docs: Closes #339

extensions/shield.py

@@ -0,0 +1,28 @@
+"""Shield integration — crisis detection and jailbreak pattern scanning.
+
+This module restructures agent/shield.py as a timmy-config extension.
+Original file existed in hermes-agent/agent/shield.py and imported
+`tools.shield.detector`. We re-export the same interface.
+"""
+
+from tools.shield.detector import ShieldDetector, Verdict, CRISIS_SYSTEM_PROMPT, SAFE_SIX_MODELS
+
+_detector = None
+
+def get_detector():
+    """Get or create the global Shield detector instance."""
+    global _detector
+    if _detector is None:
+        _detector = ShieldDetector()
+    return _detector
+
+def scan_text(text: str):
+    """Scan text for jailbreaks and crisis signals using SHIELD."""
+    detector = get_detector()
+    return detector.detect(text)
+
+def is_crisis(verdict: str) -> bool:
+    return verdict in [Verdict.CRISIS_DETECTED.value, Verdict.CRISIS_UNDER_ATTACK.value]
+
+def is_jailbreak(verdict: str) -> bool:
+    return verdict in [Verdict.JAILBREAK_DETECTED.value, Verdict.CRISIS_UNDER_ATTACK.value]