Add AGENTS.md

**What** — No `AGENTS.md` or `CLAUDE.md`.

**Why it matters here** — The codegen-from-spec workflow is the non-obvious thing about this repo — an agent that hand-edits a generated file will pass review and fail the `codegen-drift` job. That belongs in a file agents actually read.

**Evidence**

```
$ ls AGENTS.md CLAUDE.md 2>&1 | tail -1
ls: cannot access 'CLAUDE.md': No such file or directory

$ grep -n 'codegen' .github/workflows/ci.yml
(job: Check generated code is in sync with spec/openapi.yaml)
```

**Fix**

Document which files are generated, how to regenerate, and the internal-reference scanning rule the `public-repo-hygiene` job enforces.

---

Found by `repo-audit` during repo improvement sweep 2026-08-17. Parent: #53