Add repo-root CHANGELOG.md and AGENTS.md

[me-bender]

Repo-hygiene fix triggered by Lunar policy failures on #50:

• changelog-exists — no CHANGELOG.md at repo root
• instruction-file-exists — no AGENTS.md / CLAUDE.md / CODEX.md / GEMINI.md at repo root

Both failures are pre-existing repo state, not anything #50 introduced — so per the repo-hygiene playbook the right action is a separate fix PR on the repo, which is this one.

What's here

CHANGELOG.md (repo root)

Thin index that points at the canonical per-chart changelog
(charts/lunar/CHANGELOG.md) and reserves a small Repo-level changes section for workflow / layout / tooling changes that aren't tied to a chart version. Picks the index pattern rather than a symlink so future charts can each contribute one bullet at the top.

AGENTS.md (repo root)

Short orientation doc covering:

• repo purpose + which chart(s) live here,
• file/directory layout,
• the bump-and-pr → chart-releaser release flow (handy because the dispatch contract crosses repos — earthly/lunar's release.yml calls into this repo),
• editing checklist + branch / PR / CODEOWNERS conventions.

Single-source-of-truth lives in AGENTS.md. If a tool-specific override is ever needed, drop a CLAUDE.md / CODEX.md / GEMINI.md next to it; the ai.instruction-file-exists check passes if any of them exist.

Why now

Every PR on this repo now fails two Lunar checks until the files exist. Better to clear them once than have every future PR carry stale red Xs.

Test plan

• CI green on this PR
• After merge, next PR on earthly/charts shows changelog-exists and instruction-file-exists as passing in the lunar-internal[bot] sticky comment

🤖 Generated with Claude Code

[lunar-internal]

🌒 Earthly Lunar

✅ 13 Passing

• ✅ branch-protection-enabled vcs.branch-protection-enabled - Requires branch protection rules to be enabled on the default branch.
  Branch protection is the foundation for all other VCS security controls.

• ✅ build-tagged container.build-tagged - Requires container builds to use an explicit image tag via -t/--tag.
  Untagged builds produce anonymous images that cannot be tracked or deployed.

• ✅ changelog-exists changelog.changelog-exists - Verifies that a CHANGELOG file exists in the repository root. Detects
  common variants (CHANGELOG.md, CHANGELOG, CHANGES.md, HISTORY.md,
  RELEASES.md). Intended for repos that ship versioned releases — apply
  via lunar-config on: targeting (e.g. public-only) rather than blanketly.
  Reads from .repo.changelog.

10 more...

• ✅ codeowners-catchall repo-hygiene.codeowners-catchall - Requires a default catch-all rule (*) in CODEOWNERS so that every file
  in the repository has at least one owner.

• ✅ codeowners-exists repo-hygiene.codeowners-exists - Requires a CODEOWNERS file to be present in the repository.
  Checks standard locations: root, .github/, or docs/.

• ✅ codeowners-valid repo-hygiene.codeowners-valid - Validates that the CODEOWNERS file has correct syntax.
  Checks that all owner references use valid formats (@user, @org/team, or email).

• ✅ disallow-force-push vcs.disallow-force-push - Prohibits force pushes to protected branches to preserve commit history.
  Force pushes can destroy audit trails and cause data loss.

• ✅ instruction-file-exists ai.instruction-file-exists - Verifies that an agent instruction file exists at the repository root. Checks
  ai.instructions.all[] which is populated by the ai collector (AGENTS.md) and
  tool-specific collectors via array append (CLAUDE.md, CODEX.md, GEMINI.md).
  Passes if any entry exists.

• ✅ no-latest container.no-latest - Prevents use of the :latest tag (explicit or implicit) in base images.
  Using :latest creates non-reproducible builds and makes debugging difficult.

• ✅ readme-exists repo-hygiene.readme-exists - Verifies that a README file exists in the repository root.
  Every repository should have basic documentation for discoverability.

• ✅ require-default-branch vcs.require-default-branch - Validates the default branch name matches the required name (default "main").
  Helps standardize branch naming across repositories.

• ✅ require-pull-request vcs.require-pull-request - Requires all changes to go through pull requests before merging.
  Prevents direct pushes to protected branches without review.

• ✅ stable-tags container.stable-tags - Requires base images to use stable tags: digests (sha256:...) or full semver (1.2.3).
  Partial versions like "node:20" can change unexpectedly and break builds.

More Details

[me-bender]

Closing as a self-duplicate — I missed that earlier sessions already opened #46 (AGENTS.md) and #48 (CHANGELOG.md) for the same two failing checks. Those two are the canonical PRs going forward.