Move the agent working rules into the repo

[pfefferle]

Proposed changes:

Over the last months a lot of "how we do things here" only lived in my agent's private memory, one note per correction. That is invisible to any other agent (and to me a week later). This PR moves the parts that are facts about the plugin into the repo, where every agent reads them:

• AGENTS.md: never remove an escaping, sanitizing or capability check; never change a hook's priority or signature; cleanups change no behaviour; a docblock is a claim, not evidence.
• code-style skill: comments explain the mechanic, not the bug; no try/catch; no "C2S" in code; to_array( false, false ) for anything that leaves the server; when duplication beats a helper.
• release skill: how to pick the changelog significance, one entry per user-visible change, no entry for bugs that never shipped, neutral release PR bodies.
• pr skill: bare backticks in PR text.
• dev skill: check externalized @wordpress/* exports against the shipped wp.* global.
• security-audit agent: a "Fixing What You Find" section (permission before rate limit, fix the class not the instance, generic entries, disclosure).
• Two one-line code comments in class-menu.php for decisions that kept getting questioned (the reader UI opt-in, the ⁂ suffix).

Docs and comments only, no functional change.

Testing instructions:

• Read the diff.