Establish public verified release boundary

AGENTS.md

@@ -0,0 +1,32 @@
+# AGENTS.md
+
+`ink-releases` is the public, source-free distribution boundary for private Ink repositories.
+
+## Authority
+
+- Read `REQUIREMENTS.md` before durable changes.
+- `REQUIREMENTS.md` is authoritative; generated artifacts and private source repositories are evidence.
+- Update requirements before changing durable installer, publication, integrity, or platform behavior.
+- Keep strict Redgate proof current. `req:` is traceability; accepted local `test` edges are proof.
+
+## Boundaries
+
+- Never copy private source, credentials, deploy keys, policy, profiles, or configuration here.
+- `ink` publication owns only `install.sh`, `channels/*/ink`, and `releases/*/ink`.
+- `ink-toolset` publication owns only `channels/*/toolset` and `releases/*/toolset`.
+- Published executables are individual static x86_64 Linux-musl assets; do not add bundles.
+- Installation writes executable files only. Never edit PATH, shell configuration, policy, or credentials.
+
+## Work tracking
+
+Work is tracked in Gitea Issues for `tmk241/ink-releases`. Do not mirror issues into local files. Do not create, close, or relabel issues without explicit user authority.
+
+## Verification
+
+```sh
+bash -n install.sh
+python3 test/installer_e2e.py
+redgate lint < requirements.tsv
+```
+
+Final reports must include `REQUIREMENT IMPACT: IDs` or `REQUIREMENT IMPACT: none`.