docs: add .github/copilot-instructions.md and AGENTS.md

[Copilot]

Establishes repo-local agent operating instructions so Copilot/Codex work in source-os is issue-first, bounded, and validation-backed.

Changes

• .github/copilot-instructions.md — Copilot coding-agent guidance:

  • Issue-as-source-of-truth, bounded PRs, no unrelated changes
  • High-risk path table (hosts, images, profiles, modules, systemd units, eBPF, runtime, workflows, channels/configs) with risk categories
  • SourceOS-specific rules per path class (boot/install/recovery, host mutation, workflows, runtime admission)
  • PR body template enforcing: what changed · commands run · output summary · known gaps · blocked on

• AGENTS.md — agent operating instructions:

  • Cardinal rule: one repo, one issue, one PR
  • Scope, validation-evidence, and non-goal definitions
  • Per-path-class validation requirements (e.g. nix flake check for Nix expressions, quorum/anchor smoke for runtime admission, shellcheck/bash -n for install scripts)

Validation

test -s .github/copilot-instructions.md
test -s AGENTS.md
grep -F "Use the GitHub issue body as the source of truth" .github/copilot-instructions.md
grep -F "One repo, one issue, one PR" AGENTS.md

All four commands pass.