docs(agents): refresh knowledge base docs

[marcusrbrown]

• regenerate top-level AGENTS.md metadata and architecture map
• update module AGENTS.md files under features/* and services/*
• align file/component tables with current structure and naming
• remove stale/duplicated sections and legacy references
• normalize execution-flow and hotspot descriptions for current codebase

[fro-bot]

Good documentation refresh — the changes significantly improve accuracy and consistency across the knowledge base. Here's what I verified against the code:

Verified correct ✅

• Source file count: 88 → 132 files, 13k → 13.6k lines (matches find src/ -name '*.ts' | wc -l)
• post.ts corrected to point at harness/post.ts (was wrongly pointing at run.ts)
• NormalizedEvent: 7 → 8 variants matches the union in src/services/github/types.ts (added NormalizedDiscussionCommentEvent and NormalizedUnsupportedEvent since the old count)
• Session storage: storage-read.ts/storage-write.ts → storage.ts/storage-mappers.ts is accurate
• cache-restore phase addition to execution flow matches src/harness/phases/cache-restore.ts existing
• Removal of the ],op: corruption artifacts that littered the old module docs
• Renaming **Prompting (Old)** to **Prompt** in agent/AGENTS.md (stale label)
• Removing the duplicated ensureOpenCodeAvailable entry in agent KEY EXPORTS

One inaccuracy to flag 🔍

The execution flow in the top-level AGENTS.md attributes writeJobSummary to the cleanup phase:

├─→ finalize phase (writeSessionSummary, pruneSessions)
└─→ cleanup phase (saveCache, writeJobSummary)       ← incorrect

The code places these differently:

Function	Actual phase file
writeSessionSummary	execute.ts (line 120), not finalize
pruneSessions	cleanup.ts (line 53), not finalize
writeJobSummary	finalize.ts (line 41), not cleanup

The accurate flow would be:

├─→ execute phase (executeOpenCode via SDK, writeSessionSummary)
├─→ finalize phase (writeJobSummary, setActionOutputs, postErrorComment)
└─→ cleanup phase (pruneSessions, saveCache, writeJobSummary)

Note that pruneSessions-in-finalize was a pre-existing inaccuracy that this PR carries forward; writeJobSummary-in-cleanup is a net-new error introduced here. Low severity since it only affects navigation, but worth correcting since the execution flow table is the primary agent orientation landmark.

Minor: removed security context from setup/AGENTS.md

The setup module previously documented credential hygiene (auth.json 0o600 perms, ephemeral credentials, git identity enforcement, binary isolation). That context was dropped in favor of a lighter table format. Since the setup module is the only place that writes auth.json with token contents, agents missing that context could inadvertently expose credentials. Consider keeping the SECURITY section or folding those constraints into ANTI-PATTERNS.

---

Run Summary

Field	Value
Event	pull_request
Repository	fro-bot/agent
Run ID	22790501411
Cache	hit
Session	ses_339c98207ffeSSPLJmRJ9InS62