GitHub Copilot supports per-repo review instructions at
.github/copilot-instructions.md (≤2 pages, applied to every Copilot
PR review automatically). Adds calciforge-specific guidance to
improve signal-to-noise:

- Skip what pre-commit already gates (fmt, clippy, gitleaks)
- Prioritize HIGH-severity classes that bit us in past reviews:
  secret leakage in logs, substitution-boundary correctness,
  unwrap/expect outside tests, missing unsafe around set_var
  (edition 2024), blocking I/O in async, auth bypass paths
- Tell Copilot what's NOT a bug despite looking like one:
  {{secret:NAME}} sentinel syntax, post-history-scrub fake test
  values, FnoxClient subprocess-by-design, clashd/zeroclaw_*
  upstream references, mixed Rust edition (known)
- Past-mistake checklist (6 classes from real findings that
  landed and were caught later — substitution-after-bypass,
  None dest_host, bearer-in-info-log, fnox set argv leak,
  0.0.0.0 default, hardcoded fallback URLs)
- Skip even-if-correct: 'consider adding tests' without
  specifics, rename suggestions vs. functional convention,
  feature-creep proposals

Cross-references AGENTS.md (host-agent coding standards) and
CLAUDE.md (public-repo secret discipline) so Copilot follows
both. 83 lines, well under the documented 2-page cap.

V1 of `.github/copilot-instructions.md` was ~970 words and read more like
documentation than reviewer guidance. Two issues that hurt signal:

1. **Length** — Copilot's per-repo instructions read window is ~4000
   chars; v1 was over that, so the trailing past-mistake list and
   skip-list were getting truncated.
2. **Format** — long bulleted exposition reads less like a rule and
   more like prose, which Copilot treats as background context rather
   than as constraints to apply.

V2 changes:

- Cuts to ~3500 chars by condensing the prioritization tiers and
  removing per-class HIGH/MED/LOW exposition (the priority-order list
  carries the same info in 5 lines).
- Leads with a single review philosophy line ("if uncertain, do not
  comment"), the highest-leverage rule borrowed from deno's
  copilot-instructions.md.
- Names specific past Copilot noise patterns from this repo's PR
  history (env-mutex/serial_test repeated 8+ times across #19/#22/#23;
  dead-doc-reference 4x across #20/#23/#25) so the "don't repeat
  across PRs" rule has teeth.
- Cross-references a new path-scoped file at
  `.github/instructions/rust.instructions.md` (`applyTo: "**/*.rs"`),
  which carries the Rust-specific review nits (`#[expect]` over
  `#[allow]`, `// SAFETY:` requirement, `Mutex` across `.await`,
  `select!` cancellation safety, `kill_on_drop`, `&str` over
  `&String`, `LazyLock<Regex>` for hot paths, etc.).

Path-scoped instructions are loaded only when a PR touches a file
matching `applyTo`, so Rust-specific rules don't burn the global
4000-char budget on PRs that only touch docs / TOML / shell.

The root `AGENTS.md` was titled "Calciforge Host-Agent" and carried
host-agent-specific build/architecture rules — at the repo root, where
agents (Claude Code, Codex, Copilot cloud agent, OpenClaw) read it as
workspace-wide guidance. The mismatch meant agents working in any
non-host-agent crate were getting irrelevant rules ("ZFS snapshot
delegation", "mTLS CN→Unix user") and missing the actually-shared
ones (substitution-boundary order, sentinel string contract,
public-repo secret discipline pointer).

Restructure:

- Move the existing host-agent content verbatim to
  `crates/host-agent/AGENTS.md` (`git mv` so history is preserved).
- New root `AGENTS.md` covers the whole workspace: crate inventory,
  project vocabulary, mandatory rules every agent must follow
  (CLAUDE.md secret discipline, pre-commit gate, sentinel contract,
  substitution boundary order, no-secret-values-in-logs, fnox stdin
  mode), workspace build/test commands, and pointers into per-area
  files (`crates/host-agent/AGENTS.md`, `docs/rfcs/`,
  `docs/security-gateway.md`, `docs/model-gateway.md`).

Cross-refs `.github/copilot-instructions.md` and
`.github/instructions/rust.instructions.md` so agents that find
AGENTS.md first can pick up the Copilot-specific tuning if relevant.

Pairs with the copilot-instructions tightening earlier on this branch.

…uctions

Copilot's review caught a real factual error in v2: the line claimed
specific literals (`+15555550100`, `7000000001`, `eyJ0eXAi...`) were
allowlisted in `.gitleaks.toml`. They aren't — `7000000001` is even
used in non-allowlisted source (`crates/calciforge/src/auth.rs`). The
real allowlist mechanism is path-based (`tests/**/fixtures/`,
`docs/rfcs/*.md`, lockfiles, etc.) plus a small regex list (loopback,
RFC 5737, a few inherited-from-main values).

Replace the misleading "these specific literals are allowlisted" claim
with an accurate description of how the allowlist actually works, so
Copilot doesn't downgrade real findings on the assumption they fall
under a non-existent literal-match exemption.

Pleasingly meta: this is exactly the "verify against the codebase
before commenting" rule from the same file working as intended on the
PR that introduced the file.