chore(agents): make local checks targeted and setup non-destructive

[JArmandoAnaya]

The agent-policy consolidation that merged as the one-home-per-rule change (#705) left two gaps on main. The check policy still required a full local bash scripts/check.sh run once before every pull request, kept "every commit leaves the checks above green", and escalated two whole change categories straight to the full gate — each of which reads, to a coding agent, as an instruction to run the entire repository locally before ordinary work is allowed to complete. And scripts/setup_agents.sh deleted a regular CLAUDE.md to replace it with the AGENTS.md symlink, which is destructive toward a file that may carry a developer's local configuration.

What changed

The policy now says one thing, in AGENTS.md ## Checks, and the other documents point at it: local development runs the smallest set of checks that gives real feedback on the change, GitHub Actions runs the exhaustive matrix on every pull request, and reading what CI answered is part of pushing. High-risk changes escalate to broader relevant checks — the real-server cycle scenario for anything touching state, gating or progress, the generation/drift checks and stub-driven browser specs for a published wire shape — never automatically to every test in the repository. scripts/check.sh keeps all of its groups and remains the comprehensive local run for the moments a developer deliberately chooses its cost: reproducing a CI failure, debugging an integration problem, validating a high-risk change locally. It is no longer described as a routine step before a commit, push, or pull request. CONTRIBUTING.md, refactor-protocol, python-setup and nodejs-setup were reconciled to the same statement; "Report failures verbatim. Never claim a check passed without running it" stands unchanged.

setup_agents.sh now creates the CLAUDE.md → AGENTS.md symlink only where no CLAUDE.md exists, and the expected symlink is recognized and left alone on re-runs. A conflicting CLAUDE.md — a regular file, a directory, or a symlink to any other target — is preserved exactly as found and fails the run: the script prints an ERROR naming what it found and the manual command that adopts the canonical text, exits non-zero, and does so before creating or pruning any skill symlink, so a conflict performs no setup at all and never prints the success message. A new regression suite, tests/scripts/setup_agents.test.mjs, runs the real script in a throwaway repository layout and holds six cases: the symlink is created where nothing exists, both runs of an idempotent pair succeed, a regular CLAUDE.md survives byte-for-byte and fails the run with nothing created, a directory survives whole and fails the run, a foreign symlink keeps its target and the error names both targets, and a deleted skill's dangling link is pruned.

Test plan

Targeted validation, which is the policy this pull request states; the exhaustive matrix is delegated to this pull request's own CI by design.

bash -n scripts/setup_agents.sh                                          clean
node --test tests/scripts/setup_agents.test.mjs                          6 pass, 0 fail
node --test tests/scripts/check_stages.test.mjs tests/scripts/docs_links.test.mjs
                                                                         18 pass, 0 fail
uv run pytest tests/architecture/test_tracked_file_sizes.py              4 passed
git diff --check                                                         clean

Found, not fixed

.gitignore lists .codex/ among the generated agent directories, but setup_agents.sh has never created it; the entry is either anticipatory or stale. Nothing in this change depends on it.