docs(agents): codify recurring review blockers in AGENTS.md

[euxaristia]

Summary

Maintainer reviews (especially multi-round threads on security, sandbox, worktrees, and platform PRs) repeatedly restate the same classes of defect. Coding agents and contributors keep reintroducing them, which burns review budget.

Goal

Extend AGENTS.md with a short, high-signal "common review blockers" section so agents fix these issues before the first review, without bloating the file.

Scope

• Docs-only change to AGENTS.md
• Capture patterns that show up across many PRs: stale merge bases, path canonicalization, secret/argv leakage, incomplete redaction, fail-open ownership checks, partial setup without rollback, missing regression tests, and scope/docs mismatches
• Keep the addition compact

Out of scope

• CONTRIBUTING.md rewrites
• CI changes
• Codifying feature-specific sandbox Windows rules