Read the shared-instruction pin from .agents

[sehkone]

Summary

aicers/agent-instructions dropped the blocks and instructions-ref inputs from its reusable drift check. This repository still passes both, at .github/workflows/ci.yml's instructions job. An unknown input to a called workflow is a startup failure, so every run here goes red before a single job begins — main included (run 31287538153), and with nothing in this repository's content at fault. No check, no test, no Markdown job runs at all until this is repaired.

Upstream now reads both values from the caller's .agents/instructions.toml, and says why in the workflow's own header: two sources can disagree, and the apply job that rewrites the pin can only write one of them, since GitHub refuses a push touching .github/workflows/ from the default GITHUB_TOKEN. The only input the reusable workflow still takes is target, which this repository leaves at its AGENTS.md default.

Scope

• Add .agents/instructions.toml carrying ref = "v2" and blocks = ["workflow", "rust"] — the same release pin and the same block list the workflow passes today, so the comparison being run is unchanged.
• Drop the with: block from the instructions job in .github/workflows/ci.yml, leaving the uses: at @main. The pin being a release tag rather than a branch survives the move: it is now ref in the new file. The workflow file itself stays at @main deliberately — upstream treats the check's scripts as mechanism that ships with the workflow, not as content that ships with the pin.

AGENTS.md itself changes in no way: which blocks this repository should carry is decided upstream in repos.json, and the blocks it does carry are already current at v2.

Non-goals

Onboarding the scheduled apply.yml caller, so this repository pulls future instruction releases on its own. That is worth doing and is not this.

Acceptance criteria

• A CI run on a pull request reaches its jobs rather than failing at startup.
• The Instructions job passes: AGENTS.md matches the workflow and rust blocks at v2, and carries no region the pin file no longer lists.
• AGENTS.md is byte-identical to what main carries today.

Note

This lands as its own change, split out of #41 (issue #37) on review. #41 also carries the identical commit, because a pull_request run reads its workflow files from the head branch, so that pull request has no CI signal whatsoever without it; once this merges, #41 rebases and the commit leaves its diff.