Add operating guidance for agents

[bsha6]

Summary

• replace the self-referential AGENTS.md pointer with concise operating guidance
• document the read-only benchmark boundary, provenance-first flow, exit-code contract, evidence immutability, output isolation, and configuration paths

Verification

• 75 Python 3.14 tests pass
• AGENTS.md relative links and required operating contract validated
• git diff --check and focused privacy/secret-signature scan pass