fix: describe fraud flag checks accurately in discovery metadata

[AgentTanuki]

GET /flags was advertised as “which agent to hire for a capability” because fraud_check had no operation label and fell back to best_agent. A retained public directory record matches the description generated by the current source.

Add the fraud-check label and select buyer intents from the existing route: /flags lists agents at or above the requested suspicion threshold, while /agents/{id}/flags returns one agent's suspicion, reasons and cluster identifier. The existing capability-search copy remains unchanged.

This changes discovery descriptions only. Pricing, payment routing, scoring, response schemas, service title and the eight-product catalogue are unchanged. It does not update an external directory or deploy the service.

Validation on the candidate, using isolated stores and an offline sandbox:

• The new regression fails on the base with three incorrect-description failures and the absent route-selector argument; its capability-search control passes.
• All 81 focused metadata, catalogue and endpoint checks pass, including the five new cases.
• The complete Python service suite passes: 2,188 passed, 10 skipped.
• npm run verify and git diff --check pass.

All tests above were run for this change. No production request, payment, external indexing action or live adoption check was performed.