docs(agents): require explicit install consent

[dliu120]

Problem and value

Agents working in this repository had no repository-local boundary separating code/review work from live Archify installation, update, or removal. This adds a fail-closed consent and scope contract. Closes #246.

Scope

• What changed: added root AGENTS.md, a Claude Code pointer, and focused regression tests for direct consent, scoped Skills CLI actions, disposable-source rejection, destination-conflict handling, and notification-only updates.
• What deliberately did not change: user-facing install commands, installer behavior, packaged Skill bytes, release identity, renderers, schemas, or generated artifacts.
• No unrelated changes: confirmed; the PR contains only the three named files.

Stability impact

• Compatibility and migration risk: none for Archify runtime or schema users; this changes repository agent instructions only.
• Renderer, validator, package, or generated-artifact risk: none; archify/SKILL.md and packaged payload bytes are unchanged.
• Failure behavior and rollback path: ambiguous discovery or destination conflicts stop before mutation; rollback is removal of the three added files.

Tests run

• node --test archify/test/agent-install-consent.test.mjs — 5 passed, 0 failed.
• cd archify && npm test — 1022 tests: 991 passed, 0 failed, 31 skipped for unavailable optional environments.
• npx -y skills add tt-a1i/archify --list --full-depth — found exactly one Skill named archify; no Skill installed.
• git diff --check — passed.
• Independent exact-snapshot general review — PASS.
• Independent exact-snapshot thermonuclear review — PASS.

Visual evidence

Not applicable; no visible product output changed. Visual review: skipped.

Generated artifacts

None. Packaged Skill source and generated inputs are unchanged, so archify.zip, Gallery pages, guides, and README proofs remain fresh.

Checklist

• I used a minimal focused change and preserved existing typed JSON behavior unless the issue requires a contract change.
• I ran the relevant targeted tests and npm test in archify/.
• I added or updated a regression test for behavioral changes.
• I checked generated artifacts and package freshness when their sources changed.
• I removed secrets, private repository content, and customer data from fixtures and screenshots.