Add AGENTS.md with repository development guidelines #48

Goal

Add a short root-level AGENTS.md with the minimum operational rules that contributors and coding agents must follow when changing this repository.

AGENTS.md must not become project documentation.

Detailed explanations, architecture decisions, conventions, and background information must stay in repository documentation and be linked from AGENTS.md when needed.

What to include

Keep the file concise and focused on rules that directly affect how changes are made.

It should include short instructions such as:

• prefer official Nextcloud and upstream mechanisms over custom replacements;
• keep images generic across Nextcloud versions while allowing explicitly justified runtime dependencies; do not embed LibreSign application code or deployment-specific policy;
• reuse existing image foundations instead of duplicating runtime definitions;
• follow the repository image naming, tagging, and traceability convention;
• include or update automated tests when runtime behavior changes;
• treat security, reproducibility, testability, and traceability as default requirements;
• verify remote downloads and third-party dependencies;
• never embed secrets in images, repository files, or workflows;
• avoid unnecessary privileges, packages, services, and network exposure;
• do not remove a working implementation before its tested replacement is ready.

Each rule should be short. If a rule needs explanation, link to the relevant repository documentation instead of expanding AGENTS.md.

References

Link only to documentation that already exists and is relevant to the rules above.

At minimum, link to the container image naming and tagging convention from #53.

Do not copy documentation content into AGENTS.md.

Do not create new documentation only to make AGENTS.md longer or more complete.

Validation commands

Include only existing and supported commands that contributors should run before opening a pull request.

Do not add new scripts, linters, test tools, or validation infrastructure as part of this issue.

If no stable validation command exists yet, do not invent one.

Out of scope

Do not use AGENTS.md to document:

• the full repository architecture;
• how the container stack works;
• deployment instructions;
• image build internals;
• tagging rules in detail;
• security policy details;
• testing strategy details;
• project history;
• roadmap or future architecture.

Do not change Dockerfiles, Compose files, workflows, image tags, runtime behavior, or test infrastructure as part of this issue.

Acceptance criteria

• A root-level AGENTS.md exists.
• The file contains only concise operational rules, links, and existing validation commands.
• Detailed explanations stay outside AGENTS.md.
• The image naming and tagging convention from Document the container image naming and tagging convention #53 is linked, not copied.
• No new policy or architecture decision is introduced.
• No runtime, workflow, image, or test behavior is changed.

Good first issue

This task is only about adding concise repository guidance.

If a rule is unclear or requires a long explanation, do not expand AGENTS.md. Ask for guidance or link to the appropriate documentation instead.