Add Testing section to AGENTS.md with test coverage table and CI reference

Author: iamontheinet

AGENTS.md

@@ -22,8 +22,11 @@ plugins/
       cortex-setup/                           ← CLI install + connection setup
 install.sh / install.ps1 / bin/install.mjs    ← one-command installers
 tests/
-  run-tests.ps1                               ← PowerShell test runner
+  run-tests.sh                                ← bash test runner (Mac/Linux)
+  run-tests.ps1                               ← PowerShell test runner (Windows)
   validate-install.ps1                        ← install validation
+.github/workflows/
+  test.yml                                    ← CI: runs tests on macOS + Windows
 ```
 
 ## Critical Rules
@@ -40,6 +43,29 @@ tests/
 - `execute_cortex.py` — spawns `cortex` CLI subprocess. Key behaviors: credential path blocking (`CREDENTIAL_PATTERNS`), break-on-result, `process.terminate()` cleanup. The `stdin=DEVNULL` fix prevents the subprocess from stealing terminal input — do not remove it.
 - `route_request.py` — scores prompts via keyword indicators and skill trigger matching. Known issue: single-word trigger matching at line 88 can produce false positives.
 
+## Testing
+
+CI runs on every PR and push to main via `.github/workflows/test.yml` (macOS + Windows in parallel).
+
+**Run locally:**
+
+```bash
+bash tests/run-tests.sh           # Mac/Linux
+.\tests\run-tests.ps1             # Windows
+```
+
+**What's covered (~23 structural checks + 75 unit tests):**
+
+| Section | Checks | What it validates |
+|---------|--------|-------------------|
+| CLIs | 5 | python3, git required; cortex, snow optional (warn) |
+| Plugin structure | 7 | plugin.json, 3 skill dirs, 9 router scripts, test files |
+| Content sanity | 8 | Valid JSON, `decide()` defined, `--permission-prompt-tool` usage, session_state functions |
+| Unit tests | 75 | `test_envelope_policy.py` (33): RO/RW/RESEARCH/DEPLOY envelope allow/deny decisions. `test_plugin_units.py` (42): session state CRUD, credential path blocking, envelope prompt building |
+| Snowflake connection | 1 | connections.toml or env vars exist (warn) |
+
+Tests exit non-zero on any FAIL. Missing CLIs and missing Snowflake config are non-blocking warnings.
+
 ## Installers
 
 The three installers (`install.sh`, `install.ps1`, `bin/install.mjs`) share the same logic: