Sync the shared public-repository agent standards

[rodchristiansen]

Adds the shared agent-standards block that every public repository in this project family
carries, as a managed section at the top of AGENTS.md. Repositories that had no AGENTS.md
get one; everything already in the file is left exactly as it was.

The block states plainly that everything committed here is public and permanent — code, commit
messages, pull request titles and bodies, issues, and the edit history of all of them — and that
a correction does not retract what was published. It then lists what must never appear in a
commit, pull request, issue, code comment or test fixture: machine and host names, internal URLs
and deployment paths, people's names, references to a private issue tracker, asset tags and
serial numbers, certificate subjects and tenant identifiers, and which software is deployed
where. Write for a reader with no access to any of that; where a real value is genuinely needed
for the software to run, it belongs in configuration with a neutral default.

It also fixes tracking and the working agreement in one place: work here is tracked by GitHub
issues in this repository (#<n>, Closes #<n>), branches are <type>/<slug> off origin/main
in a worktree, main is never pushed directly, and a merged branch is cleaned up.

The section between the BEGIN/END markers is maintained centrally and synced, so edit it at
its source rather than here — an edit inside the markers is reverted on the next sync. Anything
outside them is repo-local and is never touched.