[codex] Keep agent helpers on the lightweight core path

[sidmohan0]

Summary

• Change agent helper defaults (sanitize, scan_prompt, filter_output, create_guardrail, and Guardrail) from smart to regex so default guardrail usage does not probe optional GLiNER/spaCy engines.
• Extend no-network/core tests to cover the package-root agent helpers.
• Add an isolated import blocker test proving core import, scan, redact, protect, sanitize, prompt scanning, output filtering, and default guardrail filtering do not import optional NLP/OCR/distributed/web dependency modules.

Stacking note

This branch is stacked on PR #139 (codex/v45-release-prep) because it depends on the lazy root export baseline from DFPY-71. The PR targets dev so CI runs; after #139 merges, this diff should collapse to the incremental DFPY-74 changes.

Validation

• DATAFOG_NO_TELEMETRY=1 DO_NOT_TRACK=1 .venv312/bin/python -m pytest tests/test_no_network_core.py tests/test_engine_api.py -q
• DATAFOG_NO_TELEMETRY=1 DO_NOT_TRACK=1 .venv312/bin/python -m pytest tests/test_donut_lazy_import.py tests/test_no_network_core.py tests/test_runtime_dependency_safety.py tests/test_ocr_integration.py -q
• DATAFOG_NO_TELEMETRY=1 DO_NOT_TRACK=1 .venv312/bin/python -m pytest -m "not slow" -q
• .venv312/bin/python -m pre_commit run --files datafog/agent.py tests/test_no_network_core.py --show-diff-on-failure
• git diff --check

Refs DFPY-74