CON-53: changes to main go through a pull request

[molgerz]

Summary

Adds one explicit working rule to AGENTS.md: changes to main always go through a pull request — branch con-<n>-... off main, push, open a PR, merge once checks pass. Direct pushes are never acceptable, even when account permissions would bypass branch protection (which is exactly what happened with CON-52's direct push to main today).

Also commits the previously uncommitted "never delete or tidy up branches on its own initiative" rule that was already sitting in the working tree, so this branch carries exactly one commit per rule group.

Ticket: CON-53 — Kaneo project Akasha, task CON-53: changes to main go through a pull request (In Progress).

Done when

• AGENTS.md states that main only changes via pull request
• Change lands on a con-53-... branch and reaches main through a PR (this one)