Round 2 on the 16 new modules. Every issue found while writing the
follow-up integration tests is fixed in the source, not the tests:

- Cli scaffolds were producing uncompilable C#. HandlerScaffold now
  emits real ICommandHandler<T,TResult> / IQueryHandler<T,TResult> with
  matching record types, and ServiceScaffold writes a valid Visual
  Studio Format 12.00 .sln + per-module csproj instead of a placeholder
  comment. CliScaffoldTests parses every output through Roslyn to keep
  it that way.

- FireflySecurity dropped the BuildServiceProvider() anti-pattern
  inside AddJwtBearer. JwtBearerOptions is now configured through
  IConfigureNamedOptions, so the bearer scheme resolves through the
  real container without spinning up a duplicate root.

- FireflySession middleware was writing Set-Cookie *after* the inner
  pipeline flushed headers, which threw on any request that wrote a
  body. Cookie issuance moved before _next; persistence runs in
  Response.OnCompleted. New SessionMiddlewareTests exercises the full
  cookie round-trip via TestServer.

- Actuator BeansEndpoint now resolves via IReadOnlyList<BeanRegistration>
  so the snapshot is callable from DI; MappingsEndpoint takes
  EndpointDataSource as optional so the actuator loads cleanly outside
  ASP.NET Core hosts (test rigs, console hosts, hosted services). New
  ActuatorRouteTests covers the real /actuator/{id} routing.

- Aop AspectRegistry now scans BindingFlags.Public only — advice on
  private methods would never be reachable from the framework anyway,
  and locking it to public makes the contract explicit.

- New StarterApplicationWiringTests asserts that every module advertised
  by AddFireflyApplication actually resolves out of the container, so
  future starter-bundle drift breaks the build instead of consumers.

- Agentic README rewritten to match what actually ships: the core
  module deliberately has no provider SDK reference; consumers
  implement IChatModel against their preferred adapter. Removed the
  list of adapter packages that don't yet exist.

- Messaging.SendToAttribute removed (it was advertised but never wired);
  MessageListenerAttribute kept with a docstring noting it's a
  placeholder marker for future framework-side scanners.

- XML docs swept across FireflyResilienceOptions (every strategy bag),
  FireflySecurityOptions, AgentInvocation/AgentInvocationResult, and
  Message<T>. Every public type has at least a one-line summary.

Tests: 9 new integration tests bringing the suite to 399 total, all
green:
- SecurityMiddlewareTests (2): TestServer-driven, asserts holder bind
  + tenant header propagation
- SessionMiddlewareTests (1): cookie issued, value persisted across
  requests
- ActuatorRouteTests (1): /actuator index + /actuator/{id} 200/404
  routing
- CliScaffoldTests (4): every scaffold parses with Roslyn + sln file
  is real
- StarterApplicationWiringTests (1): all 14 modules in
  AddFireflyApplication resolve