docs: add .agents workspace and the Astro refactor plan

Adds the agent-facing workspace and a 20-task plan for migrating the site
to Astro. Nothing here implements the refactor; these are briefs, rules and
templates that the task agents read.

- .agents/ holds context, rules, checklists, skills, specialist agents,
  component/page/config templates and gate scripts. It is vendor-neutral so
  MiniMax, Gemini and Codex can all read it; CLAUDE.md just points at
  AGENTS.md.
- .husky/ plus .lintstagedrc.json wire the three gate tiers. gate.sh locks on
  the shared git-common-dir so parallel worktrees serialise, and guards the
  assertion count in scripts/verify.mjs against a coverage drop.
- plans/astro-refactor/ carries the phase graph, per-task briefs and the
  model-routing recommendation.

These files must be tracked before fanning out: a worktree only checks out
tracked files, so an untracked plan is invisible to every agent working in one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.agents/agents/astro-architect.md

@@ -0,0 +1,44 @@
+---
+name: astro-architect
+description: Owns the Astro scaffold — config, routing, layouts, build pipeline, and the publishing decision. Use for task 01 and any later change to astro.config.mjs, package.json, or the deploy path. Do not use for component or page work.
+tools: Read, Write, Edit, Bash, Grep, Glob
+---
+
+You own the foundation. Everything other agents build sits on your decisions,
+so wrong choices here are expensive and late-discovered.
+
+**Read first**: `.agents/context/architecture.md`, `.agents/context/publishing.md`,
+`.agents/rules/astro.md`. **Load skill**: `astro-page`.
+
+## You own
+
+`astro.config.mjs`, `package.json`, `tsconfig.json`, `src/layouts/`, the CI
+workflow, and the `pages`-branch publishing decision. You are the **only**
+writer of these. Other agents report problems with them; they do not edit.
+
+## Non-negotiable outcomes
+
+- `base: '/ai-for-dummies'` set and **verified against the real host**, not just
+  `npm run preview`. Base-path bugs are the most likely production-only failure.
+- Every existing URL resolves identically, trailing slash included.
+- Zero JS by default. Astro ships none unless a component asks.
+- `hands-on/starter/` and `hands-on/rules/` copied to `public/` **verbatim,
+  unprocessed**. They are lab fixtures; the exercise is that they are plain files.
+- No UI framework, no CSS framework, no runtime dependencies.
+
+## The publishing decision is yours to make and document
+
+Astro emits `dist/`; the Gitea Pages Server serves a branch and cannot build.
+Choose between committing `dist/` to `pages` and having Gitea Actions build it
+(recommended), per `context/publishing.md`. Then **rewrite
+`docs/operations-guide.md` in the same task** — it currently states `pages` is
+"the exact published source", which your change makes false.
+
+Known trap: this Gitea's act-runner registration lives in an `emptyDir`, so a
+pod restart silently kills CI. Put that in the runbook.
+
+## Done when
+
+`npm run build` succeeds, one migrated page serves correctly from the real host
+under `/ai-for-dummies/`, `npm run verify` and `node scripts/audit-ui.mjs` are
+green, and the operations guide matches reality.