chore: agent brief, Codex hook bridge and cross-agent rules sync

[EvilFreelancer]

Why

#22 was produced with Codex and shipped without a README update and with a jest.mock("axios") that the repo's testing rules forbid. Codex never saw those rules: it reads only a root AGENTS.md (absent until now) and has no glob-based rule attachment, so .claude/rules and .cursor/rules were invisible to it. Contributors working without an agent had no visible checklist either. This PR closes both gaps following the rpa-gen-rules layout.

What

• AGENTS.md is the canonical top-level brief: commands, the TDD and docs workflow that must not be skipped, easy-to-miss conventions, rule index. CLAUDE.md is a symlink to it, so Claude Code, Codex, Cursor and OpenCode read the same text.
• .codex/hooks.json and .codex/hooks/attach_rules.py, copied verbatim from the skill, inject every alwaysApply: true Cursor rule at SessionStart and the glob-matched rules before each apply_patch / Edit / Write, once per rule per session. .codex/rules.md is the human-readable index.
• .cursor/rules/*.mdc: globs are now unquoted. The bridge parser reads the value literally, so globs: "src/**/*.ts" never matched anything; verified with the probe below.
• workflow rule, both trees: README triggers now include authentication and header handling and spec loading and caching, and a change counts even when it adds no flag. The Rules sync section covers Codex, AGENTS.md and the CLAUDE.md symlink and ends with a checklist.
• architecture rule, both trees: the loader description mentions the profile headers on spec download (behavior from fix: send profile auth headers when fetching the OpenAPI spec (supersedes #22) #23), and the stale claim about a generated version.ts is gone.
• .github/pull_request_template.md: the same checklist for humans.
• .gitignore: __pycache__/, since the hook is Python.

Verification

Probe without a Codex session (echo '<event json>' | python3 .codex/hooks/attach_rules.py):

• SessionStart attaches architecture, code-style, testing and workflow, about 17k characters, under the 8000-token ceiling set in hooks.json
• PreToolUse on src/openapi-loader.ts attaches implementation-order only; a second patch in the same session attaches nothing
• PreToolUse on README.md attaches nothing

npm test 140 passed, npm run build clean; no source files change here.

After merge

Merge after #23 (the architecture rule describes its behavior). Run /hooks once in Codex per clone to trust the bridge, and again after any edit to the two hook files.

🤖 Generated with Claude Code