Add AGENTS.md for coding agents

[me-bender]

Summary

• Adds a starter AGENTS.md at the repo root documenting layout, workflow for chart changes, release flow, and tests.
• Resolves the ai.instruction-file-exists Lunar check failure flagged on Delete readme.txt #45.

Why

The Lunar check looks for an agent instruction file (AGENTS.md, CLAUDE.md, etc.) at the repo root and there isn't one. It's also genuinely useful as the repo's multi-chart layout and release flow aren't obvious to an agent dropped into the codebase cold.

Notes

• Content is a starter — happy to adjust if the team has conventions I missed (e.g. testing matrix, lint config, additional charts).
• Filed as draft. Mark ready when you'd like CodeRabbit on it.

[lunar-internal]

🌒 Earthly Lunar

❌ 3 Failing

• ❌ changelog-exists changelog.changelog-exists - Verifies that a CHANGELOG file exists in the repository root. Detects
  common variants (CHANGELOG.md, CHANGELOG, CHANGES.md, HISTORY.md,
  RELEASES.md). Intended for repos that ship versioned releases — apply
  via lunar-config on: targeting (e.g. public-only) rather than blanketly.
  Reads from .repo.changelog.

  • No CHANGELOG file found. Add a CHANGELOG.md to record notable changes per release (see https://keepachangelog.com/).

• ❌ executed sca.executed - Verifies that SCA scanning was executed on the component.
  Fails if no scanner has written to .sca.

  • No SCA scanning data found. Ensure a scanner (Snyk, Semgrep, etc.) is configured.

• ❌ ticket-present ticket.ticket-present - Ensures PRs reference an issue tracker ticket in the title.

  • PR does not reference a ticket. Include a ticket ID in the PR title (e.g. [ABC-123]).

More Details

✅ 12 Passing

• ✅ branch-protection-enabled vcs.branch-protection-enabled - Requires branch protection rules to be enabled on the default branch.
  Branch protection is the foundation for all other VCS security controls.

• ✅ build-tagged container.build-tagged - Requires container builds to use an explicit image tag via -t/--tag.
  Untagged builds produce anonymous images that cannot be tracked or deployed.

• ✅ codeowners-catchall repo-hygiene.codeowners-catchall - Requires a default catch-all rule (*) in CODEOWNERS so that every file
  in the repository has at least one owner.

9 more...

• ✅ codeowners-exists repo-hygiene.codeowners-exists - Requires a CODEOWNERS file to be present in the repository.
  Checks standard locations: root, .github/, or docs/.

• ✅ codeowners-valid repo-hygiene.codeowners-valid - Validates that the CODEOWNERS file has correct syntax.
  Checks that all owner references use valid formats (@user, @org/team, or email).

• ✅ disallow-force-push vcs.disallow-force-push - Prohibits force pushes to protected branches to preserve commit history.
  Force pushes can destroy audit trails and cause data loss.

• ✅ instruction-file-exists ai.instruction-file-exists - Verifies that an agent instruction file exists at the repository root. Checks
  ai.instructions.all[] which is populated by the ai collector (AGENTS.md) and
  tool-specific collectors via array append (CLAUDE.md, CODEX.md, GEMINI.md).
  Passes if any entry exists.

• ✅ no-latest container.no-latest - Prevents use of the :latest tag (explicit or implicit) in base images.
  Using :latest creates non-reproducible builds and makes debugging difficult.

• ✅ readme-exists repo-hygiene.readme-exists - Verifies that a README file exists in the repository root.
  Every repository should have basic documentation for discoverability.

• ✅ require-default-branch vcs.require-default-branch - Validates the default branch name matches the required name (default "main").
  Helps standardize branch naming across repositories.

• ✅ require-pull-request vcs.require-pull-request - Requires all changes to go through pull requests before merging.
  Prevents direct pushes to protected branches without review.

• ✅ stable-tags container.stable-tags - Requires base images to use stable tags: digests (sha256:...) or full semver (1.2.3).
  Partial versions like "node:20" can change unexpectedly and break builds.

More Details

[me-bender]

Same three repo-level failures as already triaged on #45 (comment here):

• ticket-present — this PR's title has no ticket ref; no backing Linear ticket exists for the AGENTS.md hygiene fix. Open to filing one and retitling if the team wants the check to pass cleanly.
• sca.executed — same as on Delete readme.txt #45: no SCA scanner configured.
• changelog-exists — same as on Delete readme.txt #45: repo's convention is per-chart (charts/lunar/CHANGELOG.md); recommend scoping the check off rather than adding a root stub.

This PR resolves the fourth one (instruction-file-exists). Not opening another fix-PR for the remaining three — they're all the same recursive shape (any hygiene-fix PR will itself fail these checks until the repo-level fix lands), better solved by adjusting lunar.yml scoping than by stacking PRs.

[me-bender]

Approved and MERGEABLE — thanks. Leaving the merge button to you; I stay hands-off on charts merges in review mode.

The 3 red lunar checks are the non-blocking repo-level ones from the triage above (ticket-present, sca, changelog-convention) — not regressions from this PR. GitHub has the merge state as CLEAN, so they aren't gating.