Studio agent contract: apps/AGENTS.md, skills, and web/server rules #1775

Parent: #1774.

Scope

Give apps/ the agent-facing contract the Go tree already has, so an agent can work on Studio without reading the whole tree.

• apps/AGENTS.md with the repo's CLAUDE.md symlink convention — a lean correction file in the spirit of the root AGENTS.md, not a second copy of the docs. Content: the pnpm-workspace commands and task studio:* entry points; the apps/contracts drift rule (Zod schemas → committed openapi.json → generated Hey API client, and the CI drift gate); the BFF security invariants that must not regress (sealed HttpOnly cookies with public-URL-derived flags, double-submit CSRF on mutations, same-origin check, per-client rate limiting with trusted proxy hops, single-flight refresh, server-side 401 gating, the STUDIO_IMAGE=1 / STUDIO_ALLOW_UNAUTHENTICATED=1 refusals); the standing "published @stacklok-oss/mecatl-sdk only, never sdk/typescript" rule; and the MECATL_* (target) vs STUDIO_* (Studio-owned) split.
• A pointer to it from the root AGENTS.md — the root file stays lean.
• Skills under .claude/skills/ for the recurring loops, held to the bar of the existing set (to-acceptance-plan, plan-orchestrate, test-writer): add a Studio surface (contracts schema → BFF route → regenerate client → web feature → named proofs) and touch Studio configuration (the env matrix, the Dockerfiles, the task entry points — see Studio configuration sweep: env matrix, images, docs, entry points #1778).
• Rules / markdown instructions for the conventions that are currently tribal: TanStack file-route layout and routeTree.gen.ts regeneration; feature-folder boundaries in apps/web/src/features/*; "no fetch outside lib/api-client"; the Hono route + Zod schema + problem-details response shape; the Biome formatting contract.

Human decisions

• One apps/AGENTS.md, or a second one under apps/web/ once the structure work (Studio app structure: layout decision and the mechanical move #1777) settles? Decided: one apps/AGENTS.md with a CLAUDE.md symlink for now; revisit apps/web/AGENTS.md after Studio app structure: layout decision and the mechanical move #1777 (docs(studio): add the apps/ agent contract and Studio rules #2328).
• Do the rules live as markdown instruction files, or fold into apps/AGENTS.md to avoid a third place to look? Decided: path-scoped rule files under .claude/rules/ (studio-bff.md, studio-web.md, studio-tests.md); apps/AGENTS.md stays a lean correction file that links to them (docs(studio): add the apps/ agent contract and Studio rules #2328).

Contract

None — expected Routine (agent guidance and documentation only; no behaviour, contract, or interface change). Confirmed at plan time per docs/development-process.md.

Verification

task docs (matlatl strict link gate, no orphans) and task generate for llms.txt; an agent given "add surface X" produces the right file set from the contract alone, recorded on the issue as the acceptance evidence.