docs: AGENTS.md + evidence-backed scaffold (state, trials, decisions, handoff)

- AGENTS.md operating rules incl. Gitea SSH port-2222 note + known_hosts incident
- CURRENT_STATE / TODO / CHANGELOG / TRIALS
- trials: endpoint-key pairing; config-merge safety matrix 14/14 (verify.sh + output)
- docs: DECISIONS (mcode 0.6.12 bundle facts, digest-pinned), FEATURE-MATRIX, PROJECT-HANDOFF
- handoffs: TEMPLATE + 2026-10-19 initial-install record

docs/PROJECT-HANDOFF.md

@@ -0,0 +1,37 @@
+# PROJECT-HANDOFF
+
+How to resume work in this repo.
+
+## Entry sequence
+
+1. `CURRENT_STATE.md` — objective, what's confirmed, exact next action.
+2. `TODO.md` — prioritized work with acceptance criteria.
+3. Latest file in `handoffs/` — where the last stage stopped and why.
+4. `TRIALS.md` — don't repeat what a verdict already settled.
+5. `git status` + `git log` — see what's in flight.
+
+## Authoritative records
+
+- Decisions + verified mcode internals: `docs/DECISIONS.md` (D2 is release-pinned —
+  re-verify after mcode updates).
+- Capability truth table: `docs/FEATURE-MATRIX.md` (update status as evidence lands).
+- Regression gate for the installer: `trials/config-merge-safety-2026-10-19/verify.sh`
+  (must pass 14/14 before committing installer changes).
+- Host-specific facts (Gitea SSH on 2222, key fingerprints): `AGENTS.md` → "SSH to Gitea".
+
+## Handoff protocol
+
+At a meaningful stage boundary write `handoffs/<date>-<topic>.md` from
+`handoffs/TEMPLATE.md`: stopping point, verified results + evidence links, corrected
+assumptions, blockers, exact next action with acceptance criteria, reproduction
+commands, and git state (branch, commit, push result). Preserve prior handoffs; link
+artifacts instead of duplicating logs.
+
+## Environment assumptions (this project)
+
+- Linux host `mewtwo` (Ubuntu-based, PVE); MiniMax Code 0.6.12 at
+  `~/.minimax-code/releases/0.6.12/`; data dir `~/.minimax/`.
+- `secretvault` CLI at `~/.local/bin/secretvault`; secret `zai_api_key` (production).
+- Remote: `git@git.itsaygea.com:admin/mcode-sl.git` — port 2222, see `AGENTS.md`.
+
+Nothing above is portable to other machines without re-verification (see FEATURE-MATRIX).