docs: add AGENTS.md + authorization enforcement gates

NEW: AGENTS.md — complete agent workflow documentation
- Step-by-step PR workflow for all agents
- Authorization matrix (who can change which contracts)
- Emergency bypass procedure
- Quick start commands

NEW: scripts/prose-auth-check.sh — authorization enforcement
- Blocks unauthorized agents from changing CRITICAL contracts
- infrastructure-control, proxmox-monitor: abiba only
- hermes-config-template: abiba, mumuni, tanko
- zulip-health: abiba, mumuni
- All scripts: abiba only
- Fails CI if unauthorized changes detected

UPDATED: .gitea/workflows/pr-pipeline.yaml
- Added Stage 0: auth check (runs first)
- Added gate job that confirms all 4 checks passed
- Expanded trigger paths to include scripts/*.sh

UPDATED: branch protection — now requires 4 contexts:
  pr-pipeline / auth, validate, lint, ai-review

.gitea/workflows/pr-pipeline.yaml

@@ -1,13 +1,27 @@
-name: PR Pipeline — Validate → Review → Merge
+name: PR Pipeline — Authorize → Validate → Review → Merge
 on:
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
       - '**.prose.md'
+      - 'scripts/**.sh'
+      - '**.yaml'
+      - '**.yml'
 
 jobs:
+  auth:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Authorization check
+        run: bash scripts/prose-auth-check.sh
+
   validate:
     runs-on: ubuntu-latest
+    needs: auth
     steps:
       - uses: actions/checkout@v4
 
@@ -37,24 +51,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Structure + regression lint
+      - name: Structure + regression + consistency lint
         run: bash scripts/prose-lint.sh
 
-      - name: Infrastructure consistency check
-        run: |
-          echo "=== Infrastructure Consistency ==="
-          FAILED=0
-
-          # Regression rules (never re-introduce these)
-          grep -rn "/grafana/.*harness-grafana\|location.*\/grafana\/" *.prose.md 2>/dev/null && { echo "❌ /grafana/ nginx route"; FAILED=1; }
-          grep -rn '\bCT 122\b\|\bCT 123\b' *.prose.md 2>/dev/null && { echo "❌ Stale CT 122/123"; FAILED=1; }
-          grep -rn '\.19.*Zulip\|Zulip.*\.19\|192\.168\.68\.19' *.prose.md 2>/dev/null && { echo "❌ Stale .19 IP"; FAILED=1; }
-          STRIX=$(grep -rn "192\.168\.68\.15:8080\|\.15:8080\b" *.prose.md 2>/dev/null | grep -v "firewalled\|firewall\|:116 only" || true)
-          [ -n "$STRIX" ] && { echo "❌ Strix :8080 without firewall note: $STRIX"; FAILED=1; }
-
-          [ $FAILED -eq 0 ] && echo "✅ Consistency check passed" || { echo "❌ FAILED"; exit 1; }
-          echo "✅ Consistency OK"
-
   ai-review:
     runs-on: ubuntu-latest
     needs: validate
@@ -69,15 +68,20 @@ jobs:
           LITELLM_KEY: ${{ secrets.LITELLM_KEY }}
         run: bash scripts/prose-ai-review.sh
 
-  auto-merge:
+  gate:
     runs-on: ubuntu-latest
-    needs: [validate, lint, ai-review]
+    needs: [auth, validate, lint, ai-review]
     if: success()
     steps:
-      - name: Merge PR
+      - name: Merge gate
         run: |
-          echo "All checks passed. Merging..."
-          # Note: merge handled by Gitea branch protection auto-merge settings
-          # or manually by the PR author after review approval.
-          # This job serves as a gate — when all checks are green, merge is safe.
-          echo "✅ PR is safe to merge. Awaiting branch protection or manual merge."
+          echo "╔══════════════════════════════════════╗"
+          echo "║  ALL CHECKS PASSED — SAFE TO MERGE  ║"
+          echo "╚══════════════════════════════════════╝"
+          echo ""
+          echo "  ✅ auth       — authorized agent"
+          echo "  ✅ validate   — frontmatter valid"
+          echo "  ✅ lint       — structure + no regressions"
+          echo "  ✅ ai-review  — no contradictions with ground truth"
+          echo ""
+          echo "Merge this PR to deploy to main."