Bootstrap agent-ready docs and permissions (D-036)

Root AGENTS.md is now the single source of truth for coding agents;
CLAUDE.md, GEMINI.md and docs/CLAUDE.md are pointers. The product spec
moves from docs/CLAUDE.md to PRODUCT.md, DESIGN.md records the shipped
visual system, and docs/PERMISSIONS.md defines agent permission tiers
rendered to .claude/, .codex/ and .gemini/. Adds docs/specs/ and
docs/plans/, logs issues noticed (not fixed) in WorkBreakdown.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/Decisions.md

@@ -1126,3 +1126,28 @@ change needs its own accuracy verification against
 `tests/live-accuracy.test.ts` and `tests/live-real-model.test.ts` (a
 repetition guard can change correct-transcript wording too) before landing,
 which is out of scope for this investigation.
+
+## D-036 — Root `AGENTS.md` is the single source of truth for agents
+**Status:** Accepted (2026-10-29)
+`docs/CLAUDE.md` called itself the single source of truth, but Claude Code
+only auto-loads it when working inside `docs/`, other agents (Codex, Gemini,
+Cursor) never read it, and most of it was the generic `bun init` boilerplate
+(sample `Bun.serve`/HTML snippets) rather than repo-specific rules.
+**Decision:** a root `AGENTS.md` (read natively by Codex/Gemini, imported by
+the root `CLAUDE.md` via `@AGENTS.md`) holds the rules: verified commands, the
+conventions agents would otherwise break (Bun only, D-013 engine split, the
+transformers patch, COEP, D-020, D-030, D-032), boundaries, and docs duties.
+`CLAUDE.md`, `GEMINI.md`, and `docs/CLAUDE.md` are pointers only. The product
+spec from `docs/CLAUDE.md` §1 moved to `PRODUCT.md`; `DESIGN.md` records the
+shipped visual system (both read by the impeccable skill). Specs from the
+superpowers workflow live permanently in `docs/specs/`; plans live in
+`docs/plans/` only while work is in progress and are `git rm`'d before
+merging. Agent tool permissions are defined in `docs/PERMISSIONS.md` and
+rendered to `.claude/settings.json`, `.codex/`, `.gemini/settings.json`.
+**Kept as-is:** `docs/Architecture.md`, `docs/Decisions.md` (same filenames —
+renaming would break every existing reference) and `docs/WorkBreakdown.md`
+as the one backlog (its own rule: no separate backlog), rather than adding a
+`docs/TODO.md`.
+**Trade-off:** `AGENTS.md` is kept short (<150 lines) on purpose — rationale
+goes here, not there. Changes to it redirect every agent session, so review
+them like CI config.