docs(model-apps): consolidate the feature-flag gates and unfile the TSX lexer notes

Answering "consolidate or move?" for the 104-line Feature Flags section:
CONSOLIDATE, and keep it in AGENTS.md.

Why not move it to docs/: AGENTS.md is auto-loaded into agent context; docs/*.md
are not - an agent has to choose to open them. These are fail-closed safety gates
whose failure mode is shipping unreleased functionality, so they belong in the
always-loaded file. Moving them would make the rule less likely to be followed,
which is the opposite of the point.

Two changes, both found by reading the section rather than its title:

1. The two gate checklists were STRUCTURALLY IDENTICAL - five numbered points
   with the same five categories (discovery, scripts, deploy, ALM, codegen),
   written out twice. The shared rule is now stated once and the per-feature
   specifics live in a table, with the one genuine asymmetry called out
   separately (the connectors dispatch value overriding the plan section).
   Every fact survives - verified by grepping for the 12 load-bearing specifics
   (helper names, phase numbers, ECS setting, ALM branch, emitted APIs) after
   the edit.

2. `scripts/lib/source-literals.js - known limits` was sitting INSIDE the
   Feature Flags section. The TSX lexer has nothing to do with feature flags; it
   is a component spec that landed in the wrong place, and it accounted for a
   quarter of the section's length. Promoted to its own `## TSX source lexer -
   known limits` section. The file-tree entry that says 'see "Known limits"
   below' now points at a real section.

Net -6 lines, which undersells it: ~35 lines of duplicated prose became a table,
and ~28 lines moved to where they belong.

Also fixes line-ending drift I introduced: the restructure script joined with
\r\n on a file that is LF on main, rewriting all 850 lines. Restored to LF, so
the diff is the real 39/45. Checked the whole branch for the same mistake -
no other file changed style vs origin/main.

Docs only. Plugin suite 1474 pass, 6/6 validators.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 42626da2-b66f-4162-acaa-b1127ef23d89

Author: akshay-viz

plugins/model-apps/AGENTS.md

@@ -545,6 +545,45 @@ values in `feature-flags.json` at the plugin root.
   values in the committed file (so a typo can't silently do nothing, or — after a flip
   to `true` — accidentally enable the wrong thing).
 
+**Each gated feature has a SINGLE OWNER agent, and every entry point must go through it or the
+shared helper.** Both currently-gated features gate at the same five places, so the rule is stated
+once here and only the per-feature specifics are tabled below:
+
+1. **Discovery** — the owner agent runs the probe first; planners/edit-planners delegate to it and
+   never gate inline.
+2. **Scripts** — each entry-point script calls the shared `exitIf<Feature>Disabled()` helper (DRY —
+   never an inlined gate) and fails closed with exit 3 when OFF.
+3. **Deploy** — the SKILL phase **re-probes** the flag and treats an absent/malformed bindings
+   section as *no bindings*, so a plan authored while the flag was ON cannot deploy after it goes OFF.
+4. **ALM** — solution packaging honours the flag (or documents why it needs no gate).
+5. **Codegen** — `genpage-page-builder` emits feature code **only** when the plan carries an actual
+   binding table, never on an absent/sentinel section.
+
+| | `connectors` | `custom-api` |
+|---|---|---|
+| **Owner agent** | `genpage-connector-builder` | `genpage-customapi-builder` |
+| **Plan section** | `## Connector Bindings` | `## Custom API Bindings` |
+| **Gated scripts** | `list-connections.js`, `create-connection-reference.js` | `list-custom-apis.js` |
+| **Deploy phase** | SKILL Phase 4.5 | SKILL Phase 4.6 |
+| **ALM** | the `--connection-refs` branch of `add-page-to-solution.js` | none needed — `config.json`'s `actionBindings` travels inside the page's `uxagentprojectfile` rows automatically (the Custom APIs themselves are a separate deployment prerequisite, bound by name) |
+| **Emits** | connector code | `executeAction` / `executeFunction` / `listBoundActions` |
+
+One connectors-only nuance: at Phase 4.5 the `/genpage` orchestrator re-probes and passes the
+verbatim result as `Connectors: enabled|disabled` in every page-builder dispatch — **that dispatch
+value wins over the plan's `## Connector Bindings` section.**
+
+Both flags currently ship **OFF**, each waiting on cross-repo dependencies:
+
+- **`connectors`** — the pac CLI connector verbs (PowerPlatform-Scale-AdminTools), the GenUX
+  authoring control (power-platform-ux), and the maker/admin ECS setting must all release first.
+- **`custom-api`** — the AIBuilder CoderAgent action prompt, the shared `pai-gen-ux-action-runtime`
+  plus the UCI and Controls host runtimes, a pac CLI `model genpage upload --actions` verb to
+  persist `actionBindings` into `config.json`, and the `GenUxPluginActionAllowList` ECS setting.
+  Note the maker-facing name is "Custom API" while the shipped wire contract stays
+  `actionBindings` / `executeAction` (see `references/custom-api.md`).
+
+## TSX source lexer — known limits
+
 **`scripts/lib/source-literals.js` — known limits.** It is a hand-rolled TSX lexer, not a
 parser: the plugin ships dependency-free, so there is no TypeScript to call. It tracks
 code / line comment / block comment / string / template / regex / JSX tag / JSX text, and
@@ -573,51 +612,6 @@ Residual limits, accepted deliberately:
 Neither shape occurs in the corpus, and both fail *loudly* (exit 3, retryable) rather than
 silently. If you hit one, widen the tests first.
 
-**Connectors gate — the single owner is `genpage-connector-builder`.** Every connector
-entry point must go through it or the helper; the checklist of places that gate:
-
-1. Discovery + codegen — the top-level `/genpage` orchestrator dispatches
-   `genpage-connector-builder`, which runs the initial probe. At Phase 4.5 the
-   orchestrator re-probes with
-   `node "${PLUGIN_ROOT}/scripts/lib/feature-flags.js" connectors` and passes the
-   verbatim result as `Connectors: enabled|disabled` in every page-builder dispatch;
-   this dispatch value wins over the plan's `## Connector Bindings` section.
-2. Scripts — `list-connections.js` / `create-connection-reference.js` (`exitIfConnectorsDisabled`).
-3. Deploy — SKILL Phase 4.5 **re-probes** the flag and treats absent/malformed
-   `## Connector Bindings` as no bindings (a plan authored while ON must not deploy
-   connectors after OFF).
-4. ALM — the `--connection-refs` branch of `add-page-to-solution.js`.
-5. Codegen — `genpage-page-builder` emits connector code only when the plan has an
-   actual binding table (never on an absent/sentinel section).
-
-The **`connectors`** flag currently ships OFF: GenPage connector support needs the
-pac CLI connector verbs (PowerPlatform-Scale-AdminTools), the GenUX authoring control
-(power-platform-ux), and the maker/admin ECS setting to all be released first.
-
-**Custom API gate — the single owner is `genpage-customapi-builder`.** Every Custom API
-entry point must go through it or the helper; the checklist of places that gate:
-
-1. Discovery — `genpage-customapi-builder` runs the probe first (planner + edit-planner
-   delegate to it; they do not gate inline).
-2. Scripts — `list-custom-apis.js` (`exitIfCustomApiDisabled`).
-3. Deploy — SKILL Phase 4.6 **re-probes** the flag and treats absent/malformed
-   `## Custom API Bindings` as no bindings (a plan authored while ON must not deploy
-   Custom API bindings after OFF).
-4. ALM — none needed: `config.json`'s `actionBindings` travels inside the page's
-   `uxagentprojectfile` rows automatically (the Custom APIs themselves are a separate
-   deployment prerequisite, bound by name).
-5. Codegen — `genpage-page-builder` emits `executeAction` / `executeFunction` /
-   `listBoundActions` code only when the plan has an actual binding table (never on an
-   absent/sentinel section).
-
-The **`custom-api`** flag currently ships OFF: GenPage Custom API invocation needs the
-AIBuilder CoderAgent action prompt, the shared `pai-gen-ux-action-runtime` plus the UCI and
-Controls host runtimes, a pac CLI `model genpage upload --actions` verb
-(PowerPlatform-Scale-AdminTools) to persist `actionBindings` into `config.json`, and the
-`GenUxPluginActionAllowList` ECS setting to all be released first. Note the maker-facing name
-is "Custom API" while the shipped wire contract stays `actionBindings` / `executeAction`
-(see `references/custom-api.md`).
-
 ## Hooks & Validators
 
 Hooks are registered centrally in `hooks/hooks.json` (auto-loaded by the plugin