docs(governance): trim AGENTS.md narrative prose to the sober standard #NOT YET READY

[djdomi]

CLD-1786825000

Summary

Trims AGENTS.md's own narrative-heavy rule prose to the "sober" standard already applied to code comments (AG-CODE-012), and separately adopts AG-VAL-033 and closes a real AG-REL-001 gap found along the way.

Linked Issues

Refs #1578. This is a governance-doc change (Rule-Ref: AG-CI-020's own trailing paragraph): stays open with Refs, never Closes, until confirmed live on master.

What This Actually Changes

Before: many rules (especially in Agent Workflow, Required Validation, Coding Patterns) carried a 100-300+ word inline incident retelling after their normative text -- the actual must/must not/scope/exception was buried inside the story of how the rule was discovered. After: the normative text is unchanged in substance; each incident retelling is compressed to a one-sentence Bad Example: citation pointing at the real PR/issue where the full detail still lives. Nothing normative was narrowed -- every must/must not, scope, exception, rule ID, and Rule-Ref: cross-reference survives; several bare mid-sentence references were upgraded to the required Rule-Ref: form as a side effect.

What This PR Fixes / Adds

• Trims 27 rules across Agent Workflow, Required Validation (CI/VAL families), Issue And PR Tracking, and the Known Gaps notes.
• Adopts AG-VAL-033 as binding (removes "proposed, not yet adopted" from the rule text and its Rule Enforcement Matrix row) -- explicit maintainer ACK, recorded on issue release-validation-plan Part B: needs re-validation & extension entirely for upcoming release (as a living document) #1391.
• Extends AG-REL-001 to cover a language hidden inside a file declared as another type (e.g. Python committed inline inside a .sh/bash-shebang script) -- two confirmed real instances (scripts/check-pr-tracking-metadata.sh, scripts/dhcp-kea-lease-flow-simulation.sh), finding recorded on issue ci: rework of the entire CI infrastructure (rebuild/scan/promote pipeline, workflow consolidation, runner stabilization) #1095; the two scripts themselves are not rewritten here (separate scoped decision).

What Changed In Code

AGENTS.md only -- 30 commits, one per rule/decision (explicit maintainer request for this refactor specifically, so every intermediate state stays independently revertable). No other file touched.

Why This Matters For Users / Operators

No runtime/operator-visible change. This is the project's own AI-agent governance document -- easier for a human or an agent to actually read and follow when the regulatory text isn't buried in a paragraph of incident narrative.

Scope Boundaries

Does not touch AG-WF-026, AG-WF-033, AG-KD-003, or AG-GH-018 -- reviewed and found to be either purely normative (no separable incident tail) or dense technical specification (byte thresholds, CVE/version tables) where trimming would cost real content, not prose. Does not rewrite the two scripts found under the new AG-REL-001 clause (tracked on issue #1095 instead).

Risk / Rollback / Follow-up

No behavioral risk -- documentation-only. Rollback: revert any single commit (or the whole branch) independently; each rule's trim is its own commit. Follow-up: maintainer review/reconciliation of all 30 commits against the original text (in progress); the two Python-in-bash scripts flagged under AG-REL-001 remain unfixed pending a separate scoping decision.

Local Scope Evidence

AGENTS.md | 60 +++++++++++++++++++++++++++++++-----------------------------
1 file changed, 31 insertions(+), 29 deletions(-)

Validation

# Rule-ID set identical before/after (no ID added, removed, or renumbered)
git show d7e7a344:AGENTS.md | grep -oE '\[AG-[A-Z]+-[0-9]+\]' | sort -u > before.txt
grep -oE '\[AG-[A-Z]+-[0-9]+\]' AGENTS.md | sort -u > after.txt
diff before.txt after.txt   # -> no output, identical

# Rule-Ref: cross-references: no loss, several bare references upgraded to Rule-Ref: form
# (manually diffed, see PR discussion)

# Retirement stubs (AG-WF-016's no-reuse mechanism) untouched
git show d7e7a344:AGENTS.md | grep -c retired   # -> 10
grep -c retired AGENTS.md                        # -> 10

# Section headers unchanged
diff <(git show d7e7a344:AGENTS.md | grep '^## ') <(grep '^## ' AGENTS.md)  # -> no output

No CI-relevant file touched; standard governance-content checks (file-headers, check-governance-guards.sh) apply automatically via build-push.yml on this PR.

Type of change

• Bug fix
• New feature
• Refactor
• Documentation
• Chore

Changelog

Internal governance-document cleanup; no user-facing/operational change.