docs: align AGENTS commit policy and agent defaults

Share Conventional Commits rules and agent hygiene across repos.

AGENTS.md

@@ -5,20 +5,45 @@ what each umbrella app under `apps/` owns.
 
 ## Git commits
 
+Shared agent commit policy. Keep this section identical in every repo that
+uses it.
+
 - Do **not** add AI attribution of any kind: no `Co-Authored-By: Claude ...`,
-  no `Claude-Session:` trailers, no "🤖 Generated with ..." lines, in commit
-  messages or PR bodies.
+  no `Claude-Session:` / `Codex-Session:` / similar trailers, no
+  "🤖 Generated with ..." lines, in commit messages or PR bodies.
 - Use [Conventional Commits](https://www.conventionalcommits.org):
-  `type(scope): subject`. Types in use: `feat`, `fix`, `refactor`, `docs`,
-  `test`, `chore`. Scope is the app or feature area — `mail`, `email`, `vpn`,
-  `calendar`, `booking`, `link-archive`, `portal`, `web`, `ui`.
-- Subject in the imperative, no trailing period. The body explains **why** the
-  change exists, not a restatement of the diff.
-- Each commit should compile on its own. Watch for files that tie features
-  together — `router.ex` and `config/config.exs` are routinely touched by
-  several features at once, so a commit that splits them can leave an
-  intermediate revision that does not build.
-- Do not commit or push unless asked.
+  `type(scope): subject`.
+  - **Types:** `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `ci`,
+    `build`, `perf`.
+  - **Scope** (optional): short area name for what changed (app, package, or
+    feature). Omit when the change is repo-wide.
+- Subject in the imperative mood, no trailing period, ~72 chars or less.
+  Examples: `fix(auth): treat blank env as unset`,
+  `feat(ui): full-size image modal lightbox`,
+  `ci: wire multi-arch release artifacts`.
+- Body (when needed) explains **why**, not a restatement of the diff. Use
+  complete sentences.
+- Prefer focused commits. Each commit should leave the tree buildable and
+  tests passable on its own.
+- Do not commit or push unless the user asks.
+
+## Agent defaults
+
+Shared agent hygiene. Keep this section identical in every repo that uses it.
+
+- Prefer existing project tools and lockfiles; do not invent new package
+  managers, frameworks, or large dependency upgrades unless asked.
+- Do not commit, push, force-push, amend published history, or deploy unless
+  the user explicitly asks.
+- Never invent, print, or commit secrets (`.env`, API keys, private keys,
+  tokens, production passwords). Use example env files only.
+- Do not run destructive git or filesystem commands (`reset --hard`,
+  `clean -fdx`, `rm -rf` of real data) unless the user clearly requests it.
+- Prefer absolute paths in tool calls; do not create files the user did not
+  ask for (especially drive-by markdown docs).
+- Match surrounding code style. Keep changes scoped to the request.
+- When fixing a bug, prefer a regression test if the repo already has a test
+  harness and the failure is easy to pin.
 
 ## Before you push