refactor(scripts): make lexical path-containment checks consistent across eval and marketplace helpers

Summary

Four PowerShell helpers compare paths with a lexical StartsWith prefix test. This issue tracks making them consistent. It is not a security issue, and the reasoning for that conclusion is recorded below so nobody has to re-derive it.

Why this looks alarming and is not

PR #2599 fixed a genuine containment bug in the installer, where $targetFull.StartsWith($targetBase, Ordinal) passed by construction and writes escaped the target root. Anyone grepping for that expression afterwards will find these four sites and reasonably suspect the same exposure.

They were each assessed by reading the call site rather than pattern-matching the expression:

None of the four gates a filesystem write or a trust decision. Two already compare with a trailing separator. The worst realistic outcome in the other two is a slightly wrong relative path string in an inventory when one directory name prefixes another, for example agents-legacy against agents.

Proposed work

1. Build-AgentInventory.ps1 and Get-AgentDependencyMap.ps1 contain the same relativization helper duplicated. Extract it into one shared function, or at minimum make both compare with a separator-terminated prefix, matching AffectedAgents.psm1.
2. Leave MarketplaceHelpers.psm1 and AffectedAgents.psm1 alone unless the refactor absorbs them naturally; both are already correct.
3. Do not import the installer's Assert-WithinTargetRoot ancestor reparse-point walk here. That function exists to stop writes escaping a root; these sites do not write, and adding a filesystem walk to a string helper would be cost without benefit.

Acceptance Criteria

• The duplicated relativization logic exists in one place, or both copies compare separator-terminated.
• A test covers the sibling-prefix case, for example that <root>-legacy/x.md does not relativize as if it were inside <root>.
• npm run lint:ps is clean repository-wide and npm run test:ps passes.

Notes for whoever picks this up

Watch for PSUseDeclaredVarsMoreThanAssignments if you introduce a shared helper whose return value some call sites ignore; pipe to | Out-Null where only the side effect is wanted. That rule failed the build during #2599 for exactly this reason.

Verified against main at 278eb128.