docs: rewrite the agent docs and fix the last test isolation leaks

[datlechin]

Why

The agent docs, rules and skills still described the old test system: shards, gate jobs, the quarantine file and lint-as-tests. A 10-iteration soak of the Unit plan also found four tests that leak state past their case.

Change

• AGENTS.md, CONTRIBUTING.md, RELEASING.md, the PR template, tests.md, plugin-system.md, ui-lifecycle.md and the fix-issue and release skills rewritten for the current system. New ci.md and ui-tests.md rules.
• The MCP transport takes its pairing service by injection. Production passes .shared; each pairing test gets its own, so the rate limiter no longer carries over.
• WelcomeViewModelTests no longer retains itself. The Settings and sync tests wait for their late defaults writes.
• scripts/clean-test-residue.sh lists what older test runs left behind. Dry run unless --apply.

Verified

Unit plan, 10 iterations with -run-tests-until-failure: 0 failures. A Unit run leaves no new EphemeralDefaults dirs. verify.sh agent-docs passes.

Not in this PR

• The docs describe the new ruleset (five required checks, no role bypass). The live ruleset still has the old gate names: change it before merging.
• The 5 Settings UI flows fail until fix(settings): open the settings window from Cmd-comma and links #3424 merges.
• TableProApp/docs is behind the app, so verify.sh docs fails, the same as on main.