docs(review): define extension-specific review checkpoints

Problem

The repository-specific review guide covers ownership and two documentation policies but omits recurring extension risks: executable setup instructions, local/cloud runtime parity, untrusted trigger authorization, generated-source direction, and factual documentation claims.

The review corpus includes bad approvals for hallucinated install commands, incorrect runtime environment variables, unauthenticated comment triggers, and documentation that reversed the source/generated data flow.

Desired Behavior

The repository guide and AGENTS.md should describe concise, matching checkpoints that extension authors can satisfy before review.

Acceptance Criteria

• Add stable checkpoints for executable instructions, trigger authorization, sources of truth, documentation, and dependencies.
• Keep content PRs focused on one extension or one genuinely shared mechanism.
• Add matching contributor guidance to AGENTS.md.
• Suppress optional prose, tone, and refactor comments without a concrete failure.

Start by locating the repository-specific review guide and reading AGENTS.md to compare their existing documentation policies. Add matching, concise checkpoints for executable instructions, authorization, sources of truth, documentation claims, dependencies, and focused content PRs; done means both documents contain the agreed guidance and the acceptance criteria are satisfied.