…s scanners

SOUL.md, memory entries, and skill files containing emoji ZWJ sequences
(e.g. 🧙‍♂️ = 🧙 + ZWJ + ♂ + VS16) were being silently blocked as
prompt-injection attempts. ZWJ (U+200D) is in the invisible-char
blocklist for good reason — it can hide text inside benign-looking
strings — but it is also required inside emoji sequences and has no way
to hide anything harmful there.

Upstream PR NousResearch#28589 ("fix(cron): allow emoji ZWJ sequences in prompts",
a salvage of NousResearch#28164) established the precedent for this fix, but only
applied it to the cron prompt scanner via a cronjob_tools-local helper
(_strip_legitimate_emoji_zwj). The identical false positive still
affects the other three scanners that share the same invisible-char
blocklist. This PR completes the job for those three, factoring the
context check into a single shared helper instead of adding a fourth
copy of the logic.

Added shared utils.find_unsafe_invisibles() that context-checks ZWJ:
allowed between two pictographic codepoints (skipping variation
selectors), flagged everywhere else. All other invisibles in the
blocklist remain unconditionally flagged.

Callers updated:
- agent/prompt_builder.py (_scan_context_content — blocks SOUL.md et al.)
- tools/memory_tool.py (_scan_memory_content — blocks memory add/update)
- tools/skills_guard.py (scan_file — blocks skill install)

tools/cronjob_tools.py is intentionally left untouched — PR NousResearch#28589
already fixes _scan_cron_prompt.

Adds 6 tests covering:
- ZWJ inside 🧙‍♂️ (gendered emoji) — allowed
- Multi-ZWJ family emoji 👨‍👩‍👧 — allowed
- ZWJ between letters (classic injection shape) — still blocked
- Mixed legit emoji + injection ZWJ — blocked (at least one unsafe ZWJ)
- ZWSP adjacent to emoji — still blocked (only ZWJ is context-whitelisted)

221/221 tests pass across the affected test modules.

Motivation: a user SOUL.md containing 🧙‍♂️ was being silently blocked from
loading, with a [BLOCKED: ... invisible unicode U+200D] marker leaking
into the system prompt in place of the actual identity content. The
scan was eating its own foot on a legitimate, widely-used emoji sequence.