Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

…owledge [EXT-7431]

Replaces the earlier ARCHITECTURE.md (added in #2555) with a corrected
version that fixes factual drift and fills gaps surfaced during Phase 2/3
of the Golden Context workflow:

- All 19 lib/ modules are now in the module map (was missing several)
- Data flow diagrams cover the init handshake and a typical field read
- Build pipeline reflects the actual GitHub Actions release flow
  (Vault-backed trusted publishing) instead of the stale CircleCI text
- Adds Operational Knowledge: broken-release recovery (forward-fix only,
  per the 2021-09-13 postmortem), CDN dependency surface, production
  breakage triage, and the observed cross-repo testing flow
- Cross-references the 8 ADRs for architectural rationale

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift discovered during Phase 1 of the Golden
Context workflow:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI — migration completed in EXT-7067

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

…owledge [EXT-7431]

Replaces the earlier ARCHITECTURE.md (added in #2555) with a corrected
version that fixes factual drift and fills gaps surfaced during Phase 2/3
of the Golden Context workflow:

- All 19 lib/ modules are now in the module map (was missing several)
- Data flow diagrams cover the init handshake and a typical field read
- Build pipeline reflects the actual GitHub Actions release flow
  (Vault-backed trusted publishing) instead of the stale CircleCI text
- Adds Operational Knowledge: broken-release recovery (forward-fix only,
  per the 2021-09-13 postmortem), CDN dependency surface, production
  breakage triage, and the observed cross-repo testing flow
- Cross-references the 8 ADRs for architectural rationale

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift discovered during Phase 1 of the Golden
Context workflow:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI — migration completed in EXT-7067

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift discovered during Phase 1 of the Golden
Context workflow:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI — migration completed in EXT-7067

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift discovered during Phase 1 of the Golden
Context workflow:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI — migration completed in EXT-7067

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift discovered during Phase 1 of the Golden
Context workflow:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI — migration completed in EXT-7067

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

…owledge [EXT-7431]

Replaces the earlier ARCHITECTURE.md (added in #2555) with a corrected
version that fixes factual drift and fills gaps surfaced during Phase 2/3
of the Golden Context workflow:

- All 19 lib/ modules are now in the module map (was missing several)
- Data flow diagrams cover the init handshake and a typical field read
- Build pipeline reflects the actual GitHub Actions release flow
  (Vault-backed trusted publishing) instead of the stale CircleCI text
- Adds Operational Knowledge: broken-release recovery (forward-fix only,
  per the 2021-09-13 postmortem), CDN dependency surface, production
  breakage triage, and the observed cross-repo testing flow
- Cross-references the 8 ADRs for architectural rationale

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift discovered during Phase 1 of the Golden
Context workflow:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI — migration completed in EXT-7067

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift discovered during Phase 1 of the Golden
Context workflow:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI — migration completed in EXT-7067

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift discovered during Phase 1 of the Golden
Context workflow:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI — migration completed in EXT-7067

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured 96-line routing table that covers gaps surfaced during
Phases 1-3 of the Golden Context workflow:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME (active in contentful/apps), with
  notes on the host LaunchDarkly flag for the agent location and the
  no-auto-resizer invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-discoverable
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete (includes the
  KnownAppSDK union update, easily missed in the prior version)
- File stays under the 100-line cap — every line passes the litmus test
  ('would an agent discover this from config alone?' → no)

…owledge [EXT-7431]

Replaces the earlier ARCHITECTURE.md (added in #2555) with a corrected
version:

- All 19 lib/ modules are now in the module map (was missing several)
- Data flow diagrams cover the init handshake and a typical field read
- Build pipeline reflects the actual GitHub Actions release flow
  (Vault-backed trusted publishing) instead of the stale CircleCI text
- Adds Operational Knowledge: forward-fix recovery for broken releases,
  CDN dependency surface, production breakage triage, and the observed
  cross-repo testing flow

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured ~95-line routing table:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME, with notes on the host-side
  feature flag for the agent location and the no-auto-resizer
  invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-obvious
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete, including the
  KnownAppSDK union update easily missed in the prior version

…owledge [EXT-7431]

Replaces the earlier ARCHITECTURE.md (added in #2555) with a corrected
version:

- All 19 lib/ modules are now in the module map (was missing several)
- Data flow diagrams cover the init handshake and a typical field read
- Build pipeline reflects the actual GitHub Actions release flow
  (Vault-backed trusted publishing) instead of the stale CircleCI text
- Adds Operational Knowledge: forward-fix recovery for broken releases,
  CDN dependency surface, production breakage triage, and the observed
  cross-repo testing flow

…-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured ~95-line routing table:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME, with notes on the host-side
  feature flag for the agent location and the no-auto-resizer
  invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-obvious
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete, including the
  KnownAppSDK union update easily missed in the prior version

* docs: append agent section to README [EXT-7431]

Adds a 'For agents and contributors' pointer block immediately after the
project description, surfacing AGENTS.md, ARCHITECTURE.md, and
CONTRIBUTING.md for newcomers and AI agents. Existing customer-facing
Resources, Getting help, Development, and File Structure sections are
preserved verbatim.

* docs: rewrite ARCHITECTURE.md with full module map and operational knowledge [EXT-7431]

Replaces the earlier ARCHITECTURE.md (added in #2555) with a corrected
version:

- All 19 lib/ modules are now in the module map (was missing several)
- Data flow diagrams cover the init handshake and a typical field read
- Build pipeline reflects the actual GitHub Actions release flow
  (Vault-backed trusted publishing) instead of the stale CircleCI text
- Adds Operational Knowledge: forward-fix recovery for broken releases,
  CDN dependency surface, production breakage triage, and the observed
  cross-repo testing flow

* docs: rewrite CONTRIBUTING.md with corrected Node version and CI [EXT-7431]

Replaces the earlier CONTRIBUTING.md (added in #2555) with a corrected
version. Fixes factual drift:

- Node version is 24.11.0 locally (per .nvmrc) and 22+24 in the CI
  matrix — the previous doc said Node 18
- Default branch is 'main', not 'master' — release config and CI
  workflows both target main
- CI is GitHub Actions, not CircleCI

Adds previously-undocumented context: husky pre-commit hook and
lint-staged setup, .npmrc ignore-scripts security stance, dependabot
auto-merge with 15-day cooldown, semantic-release via HashiCorp Vault
trusted publishing, branch protection requirements, and a Troubleshooting
section for common local-dev failures.

* docs: restructure AGENTS.md as routing table [EXT-7431]

Replaces the earlier AGENTS.md (added in #2555) with a corrected,
restructured ~95-line routing table:

- Locations table now lists all 10 locations including LOCATION_AGENT
  (added v4.46.0) and LOCATION_HOME, with notes on the host-side
  feature flag for the agent location and the no-auto-resizer
  invariant for the home location
- Type aliases section explicitly calls out the deprecated *ExtensionSDK
  family in lib/types/api.types.ts
- 10 sharp edges, each pairing a discoverable fact with a non-obvious
  rule (public type contract, bundle size, postMessage-only transport,
  Space API freeze, dual-publish name mutation, canary forward-port flow,
  contentfulExtension global alias, dependabot priority, agent flag
  dependency, home no-auto-resizer)
- High-traffic areas section names lib/channel.ts, lib/types/index.ts,
  and lib/api.ts as hot files with concrete mitigations
- 'When adding a new location' recipe is complete, including the
  KnownAppSDK union update easily missed in the prior version

* chore: add CLAUDE project instructions and Bito review configuration [EXT-7431]

Adds two non-release-triggering artifacts:

- CLAUDE.md — project instructions for Claude Code agents working in
  this repo. Imperative, model-focused: identity, working style, sharp
  edges, verification commands, the 'when adding a new location' recipe,
  and tool boundaries (edit-allowed vs. don't-edit paths).
- .bito.yaml + .bito/guidelines/{architecture,quality,security}.md —
  Bito automated PR review configuration with three guideline files
  covering boundary rules (postMessage-only, public type contract,
  location additivity), test conventions and TypeScript style, and
  security stance (supply-chain hardening, branch protection, no
  hardcoded secrets).

Both artifacts are pure additions — no existing content modified. Type
is 'chore' because these are tooling/config files that should not
trigger a semantic-release.

* chore: align catalog-info.yaml with researched values [EXT-7431]

Replaces template placeholders with real values:

- description: replaces 'unknown' with a one-sentence summary
  (PostMessage iframe bridge, dual-publish)
- service-tier: '2' (replaces 'unknown'). Public customer-facing SDK
  shipping to many installations
- system: 'app-framework' (replaces 'unknown')
- tags: replaces template tags ('update-me', 'tier-unknown') with real
  semantic tags ('app-framework', 'sdk', 'typescript', 'library',
  'tier-2'); preserves 'sast-disabled' until SAST is wired up
- dependsOn: declares contentful-management.js as the runtime dependency
- Adds inline comment noting CODEOWNERS-based co-ownership with
  team-marketplace, since the owner field takes a single group only

Type is 'chore' because catalog metadata changes do not trigger a
semantic-release.