docs: adopt the fleet public-repo policy and its weekly sync

[quadseven]

Why

This repository is public but never received the fleet's public-repo write policy, the shared AGENTS.md and CLAUDE.md that say what may never be written into a public repository. The policy now also forbids mentioning a handle that is not part of the conversation, because the review bot's name is an unrelated real user's handle. That handle has already been notified by mistake. Tracked in infra#4472.

What changed

• AGENTS.md: the canonical policy sits at the top, followed by the <!-- repo-specific below --> marker. Everything this file said before sits below the marker, unchanged byte for byte.
• CLAUDE.md: the canonical pointer to AGENTS.md (new file).
• .github/workflows/sync.public-repo-docs.yml: a thin caller of infra-public's reusable sync, pinned by SHA. Once a week it replaces only the part above the marker and opens a PR if the policy has moved.

Acceptance criteria

• The part of AGENTS.md above the marker matches the canonical template byte for byte, and the repo's own content below it is unchanged
• A local replay of the sync's merge step reports no diff for AGENTS.md or CLAUDE.md
• The new caller passes the fleet workflow-hygiene linter

Size: S

Out of scope

• Existing workflow-hygiene findings in other workflow files of this repo.
• Editing past comments that carry a mention. Deleting one would not undo the notification.

https://claude.ai/code/session_01XQWqahhx8gRgbwi24BKwsv

[grug-tribe]

Walkthrough

This PR introduces a reusable-workflow-driven sync system for keeping this repo's public-facing policy files (AGENTS.md and CLAUDE.md) aligned with a canonical template in the quadseven/infra-public repo. It adds a weekly GitHub Actions workflow that calls the shared sync job to detect drift and open a PR, and it populates/replaces the two files with the up-to-date template content plus a clearly marked <!-- repo-specific below --> boundary so only the header sections are synced while each repo's own content below the marker is preserved. The AGENTS.md content itself is a strong public-repo policy: no real names, private hostnames/IPs, device IDs, credentials, or cross-repo references may appear anywhere (code, issues, PRs, commit messages, comments), migration from private sources must be scrubbed, and all deployment-specific values must be parameterized with placeholder examples.

Review effort: moderate (~15 min)

Changed files (3)

File	Summary	Changes
.github/workflows/sync.public-repo-docs.yml	New weekly + manual workflow invoking the shared quadseven/infra-public sync job with contents/pull-requests write permissions.	+20/-0
AGENTS.md	Replaced with the synced public-repo policy header (no real names/hosts/IPs/credentials/cross-repo refs, scrub-on-migration, parameterized config) followed by t	+134/-0
CLAUDE.md	New file pointing Claude Code (and other AI tools) to AGENTS.md as the real policy, with a sync boundary marker for repo-specific additions.	+14/-0

Shape of the change

graph TD
  subgraph "root"
    N0["AGENTS.md"]
    N1["CLAUDE.md"]
  end
  subgraph ".github"
    N2["sync.public-repo-docs.yml"]
  end

Loading

Last walked at 7e500ed42261.