docs: add AGENTS.md as canonical agent guidance

[thathaneydude]

Part of a group-wide regeneration of agent instruction files across the Corelight cloud
repos, using Opus 5.

What changed

• AGENTS.md is canonical (125 lines, rewritten from the code).
• CLAUDE.md is a one-line @AGENTS.md import directive.
• Both files are mode 100644; no symlinks. The import directive was chosen over a
  symlink because a symlink checked out on Windows with core.symlinks=false silently
  degrades into a text file containing the literal path.
• Frontmatter records generated_by: claude-opus-5[1m] and generated_at.

362 lines to 125. The old file was the longest agent doc in the group and past the point
of being read reliably.

Why record the model in the file

The audit that prompted this work looked at 27 agent instruction files across the sibling
GitLab group and could only recover model provenance for 8 of them, all from commit
trailers. A trailer records which model made the commit, not which wrote the file, and
does not survive a squash. Two lines of frontmatter make the next regeneration a lookup
rather than an inference.

Stale claims removed

Each verified against the working tree before removal:

Claim in the old CLAUDE.md	Reality
sensor-single, fleet, config/fleet are "Pending Migrations"	all three directories exist
"Next Steps": create LICENSE and .gitignore	both exist
"Next Steps": implement additional GitHub Actions workflows	4 workflows exist
"Next Steps": create working examples in examples/	examples/ exists
"Current Branch: feature/monorepo-structure-and-aws-sensor"	main
structure lists root tests/ and docs/	neither exists; tests are per-module at modules/*/*/tests/, and only three modules have a docs/ dir
commit footer should be "Generated with Claude Code"	contradicts this effort's convention

The "Next Steps" and "Migration Status" sections were dropped rather than updated. A stale
to-do list is worse than none, because an agent may spend effort creating things that are
already there.

Knowledge carried forward

• The v<SENSOR_VERSION>-<META> tagging scheme (e.g. v29.0.5-5): VERSION holds the
  sensor version and is bumped by hand, the meta counter derives from existing
  v<sensor>-* tags and resets to 1 when the sensor version changes, and auto-tag.yml
  publishes a tag plus GitHub Release on every merge to main.
• Internal module references MUST use relative paths; only external consumers use the
  github.com/corelight/terraform//modules/...?ref=<tag> form.
• The submodules/ layout and the resource-type-per-file organization.

Added: the terraform-docs gotcha

Module README Inputs/Outputs tables are generated between BEGIN_TF_DOCS / END_TF_DOCS
markers. Editing a module's variables.tf or outputs.tf without running just docs
fails CI, because just lint calls just docs-check, which runs terraform-docs in
--output-check mode. That costs a pipeline run to discover otherwise.

Verified vs not

Ran locally:

• just fmt-check passes.
• just validate passes for the AWS and GCP modules.
• just test-release passes.

Could not verify locally, stated plainly rather than glossed:

• just lint fails at its first line because tflint is not installed here.
• just docs / just docs-check need terraform-docs v0.24.0 for the
  --recursive-include-main flag; local is v0.17.0. CI pins the newer version.
• Local Terraform is 1.12.2 where CI pins 1.14.0.

Two pre-existing failures found, unrelated to this change and documented in AGENTS.md:
modules/azure/enrichment and modules/azure/sensor fail terraform validate against
azurerm 5.0.1 (service_bus_queue_endpoint_id and enable_accelerated_networking were
renamed or removed), because those modules only require >= 4.0. The same gap fails the
azure/enrichment unit test.

Nothing internal-only is included, since this repo is public: no GitLab project IDs, no
internal registry hostnames, no account, subscription, or project identifiers.