Add AGENTS.md and align the docs with the code

The brief asked for an AGENTS.md capturing the overall plan and it never
landed, while two files already pointed readers at it. It now holds the
invariants (read-only by construction, never invent a number,
unconfigured is not broken, no CDN, no guessed metric names), the locked
decisions with their reasons, the verified fleet facts, the commands, and
the four known gaps.

Also corrected the docs that had drifted:
- upsd config lives in /etc/ups on driveripper, not /etc/nut, and the
  real blocker is that upsd binds nothing on 3493 — with the sudo rules
  still needed written down in deploy/nut-sudoers.
- .env.example told operators to set `LISTEN 0.0.0.0` and `actions = -`;
  both are worse than needed. Loopback + ssh forward, and per-command
  instcmds instead of granting load.off.
- nut.py claimed the command path is gated three times and that the
  confirmation asks for the UPS name; it is gated four times and asks
  for DANGER.
- .gitignore described a tracked .agents/ roadmap that does not exist.

LLM-Generated: true

.gitignore

@@ -31,6 +31,10 @@ agent/*.tar.gz
 .idea/
 .DS_Store
 
-# Agent/pipeline scratch (the .agents/ roadmap itself IS tracked)
-.agents/phase-sessions/
-.agents/pipeline.log
+# Agent/pipeline scratch. This project's plan lives in AGENTS.md (tracked) — nothing under
+# .agents/ is anything another checkout needs, so all of it stays out.
+.agents/
+
+# The original brief for this project. Kept in the checkout as local context, not history:
+# README.md and AGENTS.md carry the decisions that came out of it.
+original_prompt.txt