docs: AGENTS.md + evidence-backed scaffold (state, trials, decisions, handoff)

- AGENTS.md operating rules incl. Gitea SSH port-2222 note + known_hosts incident
- CURRENT_STATE / TODO / CHANGELOG / TRIALS
- trials: endpoint-key pairing; config-merge safety matrix 14/14 (verify.sh + output)
- docs: DECISIONS (mcode 0.6.12 bundle facts, digest-pinned), FEATURE-MATRIX, PROJECT-HANDOFF
- handoffs: TEMPLATE + 2026-10-19 initial-install record

TRIALS.md

@@ -0,0 +1,10 @@
+# TRIALS — index
+
+Conventions and template: `trials/README.md`. Verdicts: `confirmed` / `rejected` /
+`inconclusive` / `blocked`. Before repeating a rejected/inconclusive trial, cite it and
+state what changed.
+
+| Date | Trial | Verdict | Record |
+|---|---|---|---|
+| 2026-10-19 | Which endpoint accepts which z.ai key (vault key vs credential.json clientKey) | confirmed | `trials/mcode-endpoint-key-pairing-2026-10-19/record.md` |
+| 2026-10-19 | install.sh config-merge safety matrix (atomicity, backup, refusal, embed, uninstall) | confirmed | `trials/config-merge-safety-2026-10-19/` (14/14, `output.txt`) |