docs(agents): record that the packaged asar is not bit-reproducible - #28

Why

The 0.78.1 detail wave was rebased onto the merged manage wave and rebuilt. The rebuilt asar has a different sha256 from the build the independent verifier checked, even though the two trees differ only in the port document and a build-script comment.

What changed

One row in the AGENTS.md trap table. The packaged app.asar is not bit-reproducible, so two builds of one tree in two worktrees produce different sha256 values. That makes a sha256 comparison useless as a proof that two builds are the same product, and it is easy to misread the mismatch as "the change did not take effect" or "the artifact is contaminated".

The row records the two per-build byte sources and the file-by-file comparison that does establish equality.

Verification

• The two builds hold 1337 files each, none added and none removed. Five differ: three renderer bundle copies carry the random upstream extraction directory, and two hash manifests record the tree-sitter native objects that node-gyp rebuilt with the other worktree's absolute path.
• The patched chunk view-B5Ug8wEm.js and the patched stylesheet index-lCyB53CO.css are byte-for-byte identical.
• The guards were re-run against the newly deployed asar: 6 of 6 official recipes at the official counts, 6 of 6 official-only CSS rules byte-for-byte official, 37 of 37 class tokens resolving with 0 unresolved, 102 of 102 chunks parsing and 0 quote-bug chunks.

Scope

Documentation only. No source, test or build change.