Get Agent Frontier

The "Hiring Frontier" variant group for an agent (PRD-016 FR-3).

Resolves the group: root = agent.variant_of or agent.id; members = the root plus every agent whose variant_of points at the root. Returns per-variant aggregates (pass-rate, pass^k, mean cost/task, provenance, model) computed from existing runs.

Visibility: a private requested agent is 404 for non-owners (same rule as GET /agents/{id}). Private MEMBERS are excluded for non-owner viewers (leak-safety) and included for the owner. Anonymous callers see public agents fine. No owner-only fields (user_id, keys) are ever in the response.