FEAT-011: SC-033 has no dedicated static socket.AF_INET import test (manual/runtime only)

[brettheap]

Source: FEAT-011 SC-033 coverage map (tasks.md §286) — test-coverage gap (marked [X]*).

SC-033 ("no socket.AF_INET import in app_contract/**") is currently only covered indirectly by the runtime no-network-listener test (T079) plus a manual grep. There is no dedicated static test asserting that no FEAT-011 module imports AF_INET.

Fix: add a small static test that greps/AST-scans src/agenttower/app_contract/** for socket.AF_INET (and AF_INET6) and fails if found.