refactor(config): make the agent config harness-neutral

[ethan-scitix]

Type

• refactor — code restructuring, no behavior change

Summary

Makes the repo's agent configuration harness-neutral, so opencode gets the
same instructions, skills, and post-edit checks that Claude Code already
had — without duplicating any of it.

• AGENTS.md becomes the single source of truth for project
  instructions (it was gitignored; now tracked). Root CLAUDE.md
  shrinks to a one-line @AGENTS.md import. Per-layer
  sieval/*/CLAUDE.md files keep their names — that is Claude Code's
  on-demand load mechanism, and renaming them would break it.
• Harnesses without that mechanism instead get a generated rule map in
  AGENTS.md: scripts/sync_agent_rules.py derives 16 rows from the 6
  layer files plus the paths: front matter of the 10
  .claude/rules/*.md files. Nothing is hand-copied, so a changed glob
  cannot silently drift — check_agent_rule_map (new, 15th preflight
  check) fails if the generator was not re-run.
• Skills live once at .agents/skills/<name>/SKILL.md, surfaced to
  Claude Code and opencode via symlinks (all four tracked at mode
  120000).
• The four post-edit grep rules that lived inline in
  .claude/settings.json move to scripts/post_edit_checks.py, shared
  by two callers: Claude Code's hook and .opencode/plugins/post-edit.ts
  (listens on file.edited, zero dependencies). Both pass the edited
  path as argv[1].

No Codex wiring (changed during review)

This branch originally shipped a .codex/config.toml. Review tested it
against a real Codex 0.144.4 and it registered zero hooks, with empty
warnings and errors — silent on every channel. Asked via Codex's own
hooks/list RPC:

this branch's file → {"hooks":[], "warnings":[], "errors":[]}
documented form    → {"hooks":[{... "matcher":"Bash" ...}]}

Three independent causes, each sufficient on its own:

1. command sat on the matcher table, but ConfiguredHookMatcherGroup
   carries only matcher and hooks — the handler needs a nested
   [[hooks.PostToolUse.hooks]] with type = "command".
2. matcher = "shell" matches no tool name (shell is Bash, edits are
   apply_patch). A wrong matcher still registers, so this would have
   failed silently a second time even after fixing (1).
3. Codex delivers the payload as JSON on stdin; post_edit_checks.py
   reads argv. A corrected file would still run the script with no path.

A registered hook also comes back trustStatus: "untrusted" — project
trust does not cover it.

Writing the stdin adapter is the right fix, but no Codex credential
exists in this environment (codex exec → 401), so its payload shape
cannot be observed and the result could not be verified before shipping.
A config that silently does nothing is worse than none: it reads as
wired. The file is removed; AGENTS.md records why, and Codex users run
python scripts/post_edit_checks.py <path> by hand.

Two gaps found while testing (fixed here)

• .opencode/commands/ was ignored by literal filename, so the next
  personal skill would ship: its symlink points at a gitignored target,
  and a public clone would get a dangling link. Now pattern-based like
  the two blocks above it.
• sanitize.sh's guideline allowlist was unanchored. It filters git grep
  output lines, so AGENTS.md exempted every line anywhere that merely
  named the file — BAD = "/home/u/x" # see AGENTS.md passed the
  hardcoded-path scan. Anchored to the path:lineno: prefix; CLAUDE.md
  had the same flaw and is fixed with it.

Test Plan

Automated

• Lint/format clean (ruff check && ruff format --check)
• Type check clean (ty check)
• Unit tests pass — 422 passed in tests/unit/scripts
• Full preflight green — 26 checks, including the new check_agent_rule_map
• scripts/sanitize.sh clean — no sensitive patterns

Manual

• Behavior preservation of the extracted checks: select_checks()
  fuzz-tested against a literal transliteration of the four old grep
  regexes across 20,000 random paths — 0 mismatches. This includes the
  deliberate asymmetry where .pyi does not trigger the meta check
  (the old pattern ended in \.py$), which is pinned by a test.
• Exit-0 guarantee holds on every path probed: missing binary
  (OSError caught), no arguments, unmatched path, and a check that
  actually runs and fails.
• Claude Code hook fires for real — wrote a file under
  sieval/tasks/ in a live session and captured both sync scripts
  running. Feeding the same payload to the new single-hook command
  gives 2 / 0 / 0 sync invocations for a task file, a scripts/ file,
  and an empty path.
• opencode end-to-end fires for real — a model-driven edit
  (opencode run, free muse-spark-1.3-contributor-free tier) changed
  the file, and file.edited reached the script: both sync scripts ran
  and the missing-binary path exited 0. Payload shape also matches the
  installed SDK type defs (EventFileEdited.properties.file).
  Confirmed opencode emits file.edited from inside the
  write/edit/patch tools, not from a file watcher — so the plugin
  tracks agent edits rather than any change on disk.
• Symlinks resolve; a new personal skill is now ignored across all
  three surfaces (probed by creating one), with both tracked symlinks
  still at mode 120000.
• sanitize.sh catches a self-exempting # see AGENTS.md probe line
  and stays clean on the real tree.
• Rule-map parser rejects an unreadable paths: key (reverse
  mutation: with the guard deleted, all three new cases fail with
  DID NOT RAISE).
• Codex is not wired — deliberately, see above. Nothing to verify.

Harness differences measured (documented in AGENTS.md)

Layer and scoped rules are auto-loaded only under Claude Code. Tested
on a synthetic tree: Codex never reads a CLAUDE.md below the repo root —
not even with the working directory inside that folder — and renaming the
same file AGENTS.md loads it immediately; opencode only walks upward
from the working directory. So for those harnesses the 16 layer and scoped
rules are a pointer to follow, not an injection.

Checklist

Required (all PRs)

• PR title follows conventional format (type(scope): description)
• No internal paths, credentials, or personal info in committed files
• AI-generated code has AI-Generated Code - <model> (<provider>) in module docstring
• No new upper-layer dependencies added to core/
• Deleted code verified — the four inline grep rules have exactly one
  replacement each in post_edit_checks.py, and no other caller read them

🤖 Generated with Claude Code