Bootstrap agent-ready docs and permissions (D-036)

Root AGENTS.md is now the single source of truth for coding agents;
CLAUDE.md, GEMINI.md and docs/CLAUDE.md are pointers. The product spec
moves from docs/CLAUDE.md to PRODUCT.md, DESIGN.md records the shipped
visual system, and docs/PERMISSIONS.md defines agent permission tiers
rendered to .claude/, .codex/ and .gemini/. Adds docs/specs/ and
docs/plans/, logs issues noticed (not fixed) in WorkBreakdown.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/WorkBreakdown.md

@@ -345,3 +345,35 @@ cached.
 Arbitrary Hub model ids, OAuth providers, multi-user transcript storage,
 whisper.cpp server backend, i18n of the UI.
 Promote to a milestone via a new entry in `Decisions.md` first.
+
+---
+
+## Noticed, not fixed
+Found while bootstrapping agent docs (D-036); docs-only pass, so no code changed.
+- [ ] `bun test tests/live-real-model.test.ts` fails: the `en_alien (en)` case
+      times out at its 900 s limit (2026-10-29, Linux CPU/WASM, reproduced in
+      isolation; `da_festuge` and `en_aiproblem` pass).
+- [ ] `isolate_wer2.ts` (repo root) is marked "TEMP (delete after use)" and
+      writes to a stale `/tmp/claude-1000/...` scratchpad path.
+- [ ] `docs/Architecture.md` §3 and `scripts/build.ts` say `src/pwa/icons/`
+      is "not checked in", but `icon-192.png`/`icon-512.png` are tracked.
+- [ ] No typecheck or lint: `tsconfig.json` is strict but `typescript` is not
+      installed, so nothing checks types (`bun` strips them).
+- [ ] `.gitlab-ci.yml` only builds Docker images; `bun test` never runs in CI.
+- [ ] README "Graceful degradation" says server-engine weights download into
+      the data volume; the env table, Dockerfile and D-031 say they are baked
+      into the image at `/opt/faster-whisper/models`.
+- [ ] `src/index.css` declares `color-scheme: light dark` but only has a dark
+      palette; `Inter` is listed first in the font stack but never loaded.
+
+## Recurring
+- [ ] Maintain `AGENTS.md`:
+  - **Add a rule only in response to a real failure.** When an agent repeatedly
+    gets something wrong, add one line, ideally with a code example. Do not
+    pre-empt hypothetical mistakes.
+  - **Update in the same commit as the convention change.** A stale rules file
+    actively misleads.
+  - **Prune quarterly.** Delete rules whose convention changed or whose mistake
+    no longer occurs. Keep it under 150 lines.
+  - **Optional validation:** run the same task twice in clean sessions, with and
+    without the file, and compare steps and token use.