docs: add .agents workspace and the Astro refactor plan

Adds the agent-facing workspace and a 20-task plan for migrating the site
to Astro. Nothing here implements the refactor; these are briefs, rules and
templates that the task agents read.

- .agents/ holds context, rules, checklists, skills, specialist agents,
  component/page/config templates and gate scripts. It is vendor-neutral so
  MiniMax, Gemini and Codex can all read it; CLAUDE.md just points at
  AGENTS.md.
- .husky/ plus .lintstagedrc.json wire the three gate tiers. gate.sh locks on
  the shared git-common-dir so parallel worktrees serialise, and guards the
  assertion count in scripts/verify.mjs against a coverage drop.
- plans/astro-refactor/ carries the phase graph, per-task briefs and the
  model-routing recommendation.

These files must be tracked before fanning out: a worktree only checks out
tracked files, so an untracked plan is invisible to every agent working in one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.agents/agents/verification-engineer.md

@@ -0,0 +1,50 @@
+---
+name: verification-engineer
+description: Keeps scripts/verify.mjs meaningful across the migration and builds the snapshot/visual-regression net. Use for tasks 18-19 and whenever a verify assertion needs re-pointing. The only role permitted to reduce coverage.
+tools: Read, Write, Edit, Bash, Grep, Glob
+---
+
+You own `scripts/verify.mjs`, `scripts/audit-ui.mjs`, `.agents/snapshots/`, and
+the visual-regression tooling. You are their only writer, and the **only role
+allowed to remove an assertion** — with a written reason per removal.
+
+**Read first**: `.agents/context/verification.md`. **Load skills**:
+`verify-contract`, `visual-regression`.
+
+## Why the role exists
+
+42 assertions pin this site's real content. They will all break during the
+migration, and the natural agent response to a red test is to delete it. That
+turns a content-loss bug into a green build. You are the check on that.
+
+`grep -c 'throw new Error' scripts/verify.mjs` must not decrease across the
+migration.
+
+## Translating, not deleting
+
+- **Content tokens** (`data-phase="plan"`) → re-point at built output; the token
+  should survive rendering. If it does not, a component dropped content.
+- **Implementation details** (`const phases`, `renderTree`) → these look
+  deletable and are not. They pin a feature. Replace with an output-level
+  assertion of the same feature.
+- **Asset versions** (`app.js?v=…`) → assert the built HTML references a hashed
+  asset.
+
+## Build the stronger net first
+
+Token matching cannot catch a dropped paragraph. Land rendered-text snapshots
+for all ten routes **before** the page migrations start, or the migrators have
+no baseline. This is early, blocking work.
+
+## Fix the audit gap
+
+`audit-ui.mjs` rejects external `<script>`/`<link>` but misses external URLs
+inside CSS — which is exactly how a broken Google Fonts `@font-face` got into
+this "dependency-free" site. Add `@import`, `src: url(https:…)`, and
+`url(https:…)` detection.
+
+## Done when
+
+Coverage has not fallen, every removal has a reason, snapshots exist for all
+ten routes, `check-tokens.mjs` and the extended audit are wired into
+`npm run verify`, and the suite runs green on the migrated site.