[planadecu]

Stacked on #35; merge #35 first. This PR targets gn-240-version-check-scope, so the diff shows only the GN-180 commit. When #35 merges and its branch is deleted, GitHub retargets this PR to main.

What changed

• CLAUDE.md → AGENTS.md. AGENTS.md is now a short pointer to CONTRIBUTING.md plus the agent traps it doesn't cover: don't hand-edit the generated src/lib/x402-catalog.ts; don't hit the live API or spend x402 USDC unless asked; scripts/release-* are shared with glassnode-api-ts-client; keep actions pinned by SHA.
• CONTRIBUTING.md takes the parts of CLAUDE.md humans also need that weren't there yet: detailed project layout (hooks, src/lib files, startup cache), coding conventions, the API query-parameter mapping, a new "CI and workflows (for maintainers)" section (required checks test (22)/test (24), how to bump a pinned action, the npm Trusted Publisher config, shared release scripts), and the cooldown exemption for glassnode-api/ink-uplot. Duplicated content (versioning, local commands, publish flow) was dropped. The Security section points to SECURITY.md.
• SECURITY.md (new): report privately via GitHub private vulnerability reporting, or security@glassnode.com as fallback. No bug bounty.
• .gitignore: adds .env.*, *.local, *.pem, *.key, with !.env.example so the example config stays tracked.
• Workflows (comments only): publish.yml no longer mentions the internal ticket for the repo transfer; ci.yml points to CONTRIBUTING.md instead of CLAUDE.md.
• NO_RELEASE_PATHS in scripts/check-changelog-heading.mjs keeps both AGENTS and CLAUDE (this PR deletes CLAUDE.md, so the deletion must still count as docs-only).

Not in this PR: a lint step in CI. pnpm run lint runs eslint ., but eslint isn't a dependency and there is no eslint config, so the script fails with eslint: command not found. Setting up lint is a separate change. NOTICE is unchanged.

Verification

• BASE_SHA=<main> node scripts/check-changelog-heading.mjs main: passes, no version bump needed (docs/CI-only).
• pnpm install --frozen-lockfile, pnpm test (113 tests pass), pnpm run build, and node dist/cli.js without credentials exits with "no Glassnode credentials".
• git check-ignore: .env.example is still tracked; .env.local and *.pem are ignored.

Downstream impact

None for users of the npm package. Nothing is published: no version bump, no package files changed. Agents and contributors read AGENTS.md/CONTRIBUTING.md instead of CLAUDE.md.