docs: add AGENTS.md + authorization enforcement gates
NEW: AGENTS.md — complete agent workflow documentation
- Step-by-step PR workflow for all agents
- Authorization matrix (who can change which contracts)
- Emergency bypass procedure
- Quick start commands
NEW: scripts/prose-auth-check.sh — authorization enforcement
- Blocks unauthorized agents from changing CRITICAL contracts
- infrastructure-control, proxmox-monitor: abiba only
- hermes-config-template: abiba, mumuni, tanko
- zulip-health: abiba, mumuni
- All scripts: abiba only
- Fails CI if unauthorized changes detected
UPDATED: .gitea/workflows/pr-pipeline.yaml
- Added Stage 0: auth check (runs first)
- Added gate job that confirms all 4 checks passed
- Expanded trigger paths to include scripts/*.sh
UPDATED: branch protection — now requires 4 contexts:
pr-pipeline / auth, validate, lint, ai-review
root
57605c6f16