feat(agentic-ai): track a shared global AGENTS.md

[ulises-c]

Brings the global agent instruction set under version control, mirroring the
repo-root AGENTS.md/CLAUDE.md split adopted in f9dbe01.

The problem: untracked, stale, and inert

Railguard's installer created ~/AGENTS.md on 9 Jul. On 12 Jul two
changes landed in this repo — and both went to the Claude side only:

Commit	Change	Reached ~/AGENTS.md?
f9dbe01	AGENTS.md becomes the master agent doc	no
29a2675	graphify reference removed	no

So it froze at its 9 Jul state, still pointing at ~/.Codex/skills/graphify/,
a directory that no longer exists.

The more serious finding is that it never worked at all. Its four
@rules/common/* imports resolve against ~/rules/, which does not exist —
only ~/.claude/rules was ever symlinked. Every hand-authored line in that file
has been dead since it was created. ~/.codex/AGENTS.md was a byte-identical
copy with identical defects.

That inertness is likely why the drift went unnoticed for two weeks: nothing
observably changed when it went stale.

Import semantics, verified not assumed

The first draft of this change used @../AGENTS.md. Rather than trust it, I
probed the real behavior with live claude -p runs. Three results, all
load-bearing:

Behavior	Result
@rules/common/x.md (at or below the file's own dir)	resolves
@../AGENTS.md (parent)	does not resolve
imports inside a symlinked file	relative to the symlink's dir, not its target
CLAUDE.md → @AGENTS.md → @rules/... (transitive)	full chain resolves

The second row invalidated the first draft — and since ~/.claude/CLAUDE.md is a
symlink into this repo, that broken version was briefly live. The committed
design uses sibling imports only.

Rows 1 and 3 together are also the explanation for the inert ~/AGENTS.md: a
deployed instruction file only sees rules/ if rules/ sits next to it.

The change

• agentic-ai/AGENTS.md — new, the tracked cross-agent instruction set.
• agentic-ai/rules/ — moved up from agentic-ai/Claude/rules/. None of the
  four rule files are Claude-specific.
• agentic-ai/Claude/CLAUDE.md — slimmed to @AGENTS.md plus Claude-only
  notes.
• install.sh — symlinks AGENTS.md and rules/ into ~/.claude/,
  ~/.codex/, and ~/. The sibling rules/ is mandatory, not belt-and-braces;
  omitting it is precisely the bug that made the old file inert.
• validate.sh — checks all six links.

Verification

• shellcheck --severity=warning on install.sh and validate.sh — clean
• Sandbox deploy test: backs up pre-existing real files, idempotent on re-run
  (no second backup), symlinks resolve to the tracked file
• Structural check: AGENTS.md, rules/common/general.md, and
  rules/bash/style.md all resolve from each of the three deploy locations
• Live claude -p probes for the four import behaviors above

Not done / please review

1. Nothing is deployed yet. bash agentic-ai/Claude/install.sh creates the
   symlinks; it backs up both existing AGENTS.md files first. Not run here —
   it writes to $HOME and performs a cargo install.
2. ~/rules will appear as a dotless directory in $HOME. That is the cost
   of making ~/AGENTS.md functional rather than decorative. To keep $HOME
   clean instead, drop "$HOME" from the loop in install.sh and deploy only to
   ~/.claude/ and ~/.codex/.
3. Railguard may re-inject its railguard:start/end block into CLAUDE.md
   on the next railguard install, duplicating the copy now carried in
   AGENTS.md. Worth a follow-up if it shows up.
4. Conflicts with feat(setup): --dotfiles config-only deploys, fix driftcheck Stop hook #65 on docs/CHANGELOG.md — both add an Unreleased section at
   the same insertion point. Trivial to resolve on whichever merges second.

🤖 Generated with Claude Code