chore: AGENTS.md with worktree-safety section

[randomm]

What

Author AGENTS.md for this repo. NOT a copy of pi-permissions' AGENTS.md — worktree management is exactly the operation pi-permissions warns against (do not reset/clean a worktree containing uncommitted developer work), so this plugin must be especially self-aware.

Sections

Plugin scope

One-paragraph description of what pi-worktree is and is not.

Pre-push quality gates (non-negotiable)

• biome check, tsc --noEmit, bun test
• 80%+ coverage; 85%+ for safety-critical modules

Code style & conventions

• TypeScript strict; no any, @ts-ignore, @ts-expect-error, biome-ignore
• ESM only
• Module size: 300 ideal, 500 hard
• Conventional commits with issue scope

Git workflow

• Branch naming: feature/issue-{N}-slug, chore/issue-{N}-slug, fix/issue-{N}-slug
• ALWAYS pass --base main to gh pr create
• (#N) is NOT a close keyword; use Fixes #N in PR body (this repo configured for squash_merge_commit_message=PR_BODY per issue chore: GitHub repo settings + CI workflow #5)
• After every squash-merge, verify auto-close (allow ~60s for async)

Worktree safety (the unique-to-this-plugin section)

This plugin operates on worktrees, which means agent-driven workflows on this codebase cannot use the same agent A in main + agent B in worktree pattern naively — we'd be modifying the very mechanism we're testing.

Rules:

• Do NOT use parallel worktrees of pi-worktree itself for development; use sequential dispatch on the main worktree
• All worktree operations in tests must use a temp directory (tmp/test-repos/), never the actual dev worktree
• The five footguns (branch-already-checked-out, dirty-remove, prune-before-delete, detached-HEAD, locked-leftover) are the same five contributors must avoid
• Fail-closed semantics: persistence corruption → deny operations, never silently allow

Six-pass code review lenses

security, error_handling, type_safety, performance, architecture, simplicity. Mandatory for non-trivial PRs.

Forbidden patterns

• TODO/FIXME/HACK/XXX in source
• Bypass comments (biome-ignore, ts-ignore)
• Dead code / speculative abstractions
• ALL_CAPS.md scratch files

Documentation policy

200-PR test: will this be true in 200 PRs? Yes → document principle. No → code comment or skip.

Why

Without AGENTS.md, every agent session re-derives conventions and re-discovers traps. pi-permissions paid that cost; we don't have to.

Acceptance criteria

• AGENTS.md exists at repo root
• All sections above present
• Worktree-safety section explicitly addresses the dev-on-the-plugin-being-developed paradox
• Squash-merge guidance matches actual repo settings (verify after issue chore: GitHub repo settings + CI workflow #5 lands)
• Conventional commit / PR conventions documented with examples
• Cross-references to acceptance criteria in feat: worktree plugin #2 (the five footguns) so they stay in sync

Out of scope

• Per-file Apache headers (ecosystem doesn't do this)
• Project-specific AI prompts beyond AGENTS.md