Add AGENTS.md and use Mode of Authority wording

AGENTS.md was required (C-35) and missing. Replace bare "operator" in
this session's ruling and help text per the environment orientation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89

AGENTS.md

@@ -0,0 +1,60 @@
+# risk-nexus — Agent Instructions
+
+## Repo Identity
+
+**Purpose:** the estate's risk register. It grades, reviews, escalates and hands
+over findings for publication, and keeps regulatory records. It is headless:
+files are the source of truth, and `make` is the interface. See `SCOPE.md` for
+what the repository does and does not do.
+
+**Domain:** infotech
+**Repo slug:** risk-nexus
+**Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a`
+**Workplan prefix:** `RISK-WP-`
+**Record prefixes:** `RISK-F-` findings, `RISK-REG-` regulatory records,
+`RISK-POL-` legal policies, `RISK-V-` verifications, `RISK-RULING-` rulings
+
+---
+
+## Working the register
+
+Run `make` to list every target with examples. The usual session is:
+
+```bash
+make check                          # full sweep; the inbox comes first ("question zero")
+make list                           # live findings, most severe first
+make show ID=RISK-F-0012            # one record
+make checked ID=<id> OUTCOME=clean|moved NOTE="what was seen"
+make test                           # before committing tool changes
+```
+
+Method is in `docs/method/`: severity, disclosure, review, escalation, intake
+and verification. Rulings go in `docs/rulings/`. Never record credential values,
+fingerprints, lengths or shapes in any file or message.
+
+## State Hub
+
+Workstation: `http://127.0.0.1:8000`. On railiance01, in-cluster:
+`http://10.43.68.154:8000`. The hub is a read model.
+
+- **Start:** `cat .custodian-brief.md`, then
+  `GET /messages/?to_agent=risk-nexus&unread_only=true`, and mark messages read
+  once they have been acted on.
+- **Close:** `POST /progress/` with a summary. After any change to a workplan
+  file, run `statehub fix-consistency`; its sync step pushes.
+- Never register workplans or tasks by hand. Write the file, commit, and sync.
+- Stage by explicit path, and leave other people's uncommitted files alone.
+
+## Environment and authority
+
+Read `~/the-custodian/docs/agent-environment-orientation.md` before any
+production, credential or GitOps work. Write authority in Mode of Authority
+terms: the founder's decisions are "the founder, exercising `GOVERN @ estate`".
+Never write a bare "operator". Older records in this repository still use that
+word; correct it only when you are editing the record anyway.
+
+## Credential and access routing
+
+This repository needs no credentials. If that ever changes, run
+`warden route find "<need>" --json` first. ops-warden issues SSH certificates
+only; every other credential belongs to another subsystem.