Port agent-context extension scripts to Python

[mnriem]

Part of #3277. Depends on the check-prerequisites PoC.

Tasks

• Port extensions/agent-context/scripts/{bash,powershell}/update-agent-context (~337/417 lines) to a single Python script.
• Respect agent-context-config.yml markers (context_markers.start / end) and the extension disable gate.

Acceptance

• Parity tests covering context-file upsert and remove behavior.

[PascalThuet]

One concrete regression case to cover here:

In v0.12.4, agent-context can be disabled in .specify/extensions/.registry, but the manual update script still rewrites configured context files.

Minimal repro:

mkdir -p .specify/extensions/agent-context .specify/extensions specs/001-demo

cat > .specify/extensions/agent-context/agent-context-config.yml <<'EOF'
context_file: ""
context_files:
  - AGENTS.md
  - CLAUDE.md
context_markers:
  start: "<!-- SPECKIT START -->"
  end: "<!-- SPECKIT END -->"
EOF

cat > .specify/extensions/.registry <<'EOF'
{"schema_version":"1.0","extensions":{"agent-context":{"version":"1.0.0","enabled":false}}}
EOF

echo "# AGENTS user notes" > AGENTS.md
echo "# CLAUDE user notes" > CLAUDE.md
echo "plan" > specs/001-demo/plan.md

bash .specify/extensions/agent-context/scripts/bash/update-agent-context.sh specs/001-demo/plan.md

Observed against the v0.12.4 Bash script:

agent-context: updated AGENTS.md
agent-context: updated CLAUDE.md

Expected: disabled agent-context should be a no-op and should not modify any configured context file.

Also worth covering: a lone <!-- SPECKIT START --> without a matching END currently truncates everything from that marker to EOF. A complete START/END pair should be required before replacing an existing managed block.

[marcelsafin]

Taking this as a follow-up to #3280. Plan: port update-agent-context to a single self-contained Python script at extensions/agent-context/scripts/python/ (no specify_cli import, matching the shell twins), honoring context_files/context_file, context_markers, the missing-config gate, and the feature.json-then-mtime plan fallback. Parity tests cover upsert into existing markers, append when markers are absent, and the .mdc frontmatter repair.