docs: add repository agent constraints

[sljeff]

Summary

• add a root AGENTS.md containing durable agent constraints only
• reserve synthetic configuration, signing, secret materialization, and store upload scripts for their intended workflows
• record the branch, version bump, immutable RC tag, store candidate, and promotion order
• require backward-compatible persisted-data migrations and real upgrade-path tests for future schema or encoding changes

Scope

This intentionally contains no project overview, directory guide, architecture description, feature list, or copied tool-version pins. It changes agent guidance only; it does not trigger a release or change runtime behavior.

Validation

• cross-checked every referenced script and workflow against the repository
• audited the real sqflite migration path in lib/models/helper.dart
• refined and reviewed the wording through three read-only exchanges with Grok CLI plus an independent persistence review
• ran git diff --check and a sensitive-pattern scan on the new file

Follow-up found during the audit

The repository already has a 3 → 4 migration, but it has no automated migration coverage, and the current onUpgrade path does not await db.execute. This PR documents the required invariant without mixing a runtime refactor into the policy change; migration fixtures/tests and awaited execution should be a separate focused change.