I Used 4,000 Paid Bug Bounty Reports to Build a CLI-First Security Agent