Put the AI-agent working rules in the repo #415

The working rules our AI builders follow (real end-to-end tests, the shared Ollama lock, ports, the build lock, keychain namespaces, seeded-home safety, debugging ports, one issue per PR, PR evidence) live only outside the repository, so they get lost and contributors' AI tools never see them.

Move the general rules into the repo (AGENTS.md and a linked docs/AGENT_WORKFLOW.md), leaving out anything specific to one machine, and add a "Real test" section to the pull request template asking what was run for real, on which model, with what result.