docs: AGENTS.md + evidence-backed scaffold (state, trials, decisions, handoff)

- AGENTS.md operating rules incl. Gitea SSH port-2222 note + known_hosts incident
- CURRENT_STATE / TODO / CHANGELOG / TRIALS
- trials: endpoint-key pairing; config-merge safety matrix 14/14 (verify.sh + output)
- docs: DECISIONS (mcode 0.6.12 bundle facts, digest-pinned), FEATURE-MATRIX, PROJECT-HANDOFF
- handoffs: TEMPLATE + 2026-10-19 initial-install record

handoffs/TEMPLATE.md

@@ -0,0 +1,39 @@
+# Handoff: <date> — <topic>
+
+## Objective and stopping point
+
+<What the stage set out to do; where exactly it stopped.>
+
+## Verified results and evidence
+
+<Claims with status (`confirmed`/`inferred`/`unknown`), each linked to its evidence:
+trial record, output file, digest, or command. No unevidenced claims.>
+
+## Corrected assumptions and limitations
+
+<What we believed at the start that turned out wrong; hard limits of the result.>
+
+## Unresolved questions and blockers
+
+<Open questions, with who/what is needed to resolve them.>
+
+## Exact next action
+
+<Single next step + acceptance criteria.>
+
+## Reproduction
+
+```bash
+<exact commands, host requirements>
+```
+
+## Local artifacts
+
+<Ignored/local files this work depends on and where to recover them.>
+
+## Git state
+
+- Branch: <branch>
+- Commit: <hash — never self-referential; report the final handoff commit after it exists>
+- Push: <pushed to <remote> / failed: <reason>>
+- Working tree: <clean / modified files listed>