Agents: `admin_deactivate_agent` and `flag_agent` share duplicated admin-check code

## Context The same seven-line load-admin-and-compare block appears in `flag_agent`, `admin_deactivate_agent`, and `transfer_admin`. ## Problem Duplication means a future fix to the admin check has three places to land and two chances to be missed. It is also the kind of thing that makes the file harder to read than it needs to be. ## Proposed approach Extract a private `fn require_admin(env: &Env, caller: &Address)` helper and call it from all three sites. ## Acceptance criteria - [ ] A single helper implements the admin check - [ ] All three call sites use it - [ ] Existing admin tests pass unchanged ## Where to look - `contract/agents/src/lib.rs:396` --- _Newcomers welcome._ Comment to claim this before you start so we avoid duplicate work. Setup instructions are in `CONTRIBUTING.md`; ask here if anything is unclear and someone will help.