docs: AGENTS.md + evidence-backed scaffold (state, trials, decisions, handoff)

- AGENTS.md operating rules incl. Gitea SSH port-2222 note + known_hosts incident
- CURRENT_STATE / TODO / CHANGELOG / TRIALS
- trials: endpoint-key pairing; config-merge safety matrix 14/14 (verify.sh + output)
- docs: DECISIONS (mcode 0.6.12 bundle facts, digest-pinned), FEATURE-MATRIX, PROJECT-HANDOFF
- handoffs: TEMPLATE + 2026-10-19 initial-install record

trials/config-merge-safety-2026-10-19/record.md

@@ -0,0 +1,19 @@
+# Trial: install.sh config-merge safety matrix
+
+- **Date:** 2026-10-19
+- **Question / hypothesis:** the `~/.minimax/config.yaml` surgery is atomic, idempotent,
+  backs up before change, refuses ambiguous input, keeps everything outside the `tui:`
+  block byte-identical, and works identically from a checkout or a piped install.
+- **Scope / acceptance:** the 14 checks in `verify.sh` (S1–S6) all pass.
+- **Inputs:** `install.sh` `a6c433da2cde4d92387c4de5845f6770ed71df55548499654e579869d84989a1`,
+  `zai-usage.sh` `ca2141a50b528072d7ca2a4842cd9d6c535fc036e2ff34f816fafc713fa63c61`.
+- **Environment:** bash, GNU coreutils, python3 (PyYAML present → YAML validation active),
+  mktemp sandboxes with overridden `$HOME` (no live config touched).
+- **Procedure:** `bash trials/config-merge-safety-2026-10-19/verify.sh`
+- **Expected vs observed:** expected 14/14; observed 14/14 (`output.txt`).
+  First recorded run also caught two runner-script typos (`T1b`/`T2u` under `set -u`),
+  fixed before the clean run — both were test-harness bugs, not installer bugs.
+- **Verdict:** confirmed (Linux, this host).
+- **Repeat guard / limits:** rerun after any change to `install.sh` (required by
+  `AGENTS.md`), after mcode updates that change config.yaml's generated shape, and once
+  on macOS — pass/fail there is currently `unknown` (BSD stat/date/`install` differences).