New check destructive_command: flag runnable destructive shell without warnings

[royalpinto007]

Problem

Subagents emit copy-pasteable rm -rf, DROP TABLE, kubectl delete, fork-bomb blocks the orchestrator may execute. Without a dry-run/backup warning this is how data loss happens.

Pattern

Add a check in agentrace/checks.py (sibling: check_refused_or_gave_up, head-scan regex list). Fire destructive_command (high) on destructive-command regex with no nearby caution token (dry-run, backup, --dry-run, "verify first").

Acceptance

New check destructive_command. _run(result="run: rm -rf /data/cache") flagged; same with "dry-run first" clean.

[TonMtt]

I'd like to work on this one. I'll add the destructive_command check with tests covering an unsafe destructive command and the cautioned/dry-run case.

[github-actions]

It's yours, @TonMtt. Marked this as claimed.

Take your time, and shout in this thread if you get stuck. If there's no activity for 14 days the claim is released so someone else can pick it up.