docs: add .agents workspace and the Astro refactor plan

Adds the agent-facing workspace and a 20-task plan for migrating the site
to Astro. Nothing here implements the refactor; these are briefs, rules and
templates that the task agents read.

- .agents/ holds context, rules, checklists, skills, specialist agents,
  component/page/config templates and gate scripts. It is vendor-neutral so
  MiniMax, Gemini and Codex can all read it; CLAUDE.md just points at
  AGENTS.md.
- .husky/ plus .lintstagedrc.json wire the three gate tiers. gate.sh locks on
  the shared git-common-dir so parallel worktrees serialise, and guards the
  assertion count in scripts/verify.mjs against a coverage drop.
- plans/astro-refactor/ carries the phase graph, per-task briefs and the
  model-routing recommendation.

These files must be tracked before fanning out: a worktree only checks out
tracked files, so an untracked plan is invisible to every agent working in one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.agents/scripts/gate.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Tier 2 gate: types, build, content contracts, dependency audit, tokens.
+# Invoked by .husky/pre-push, and safe to run by hand at any time.
+#
+# Parallel-safe: takes a lock in the SHARED git dir, so ten agents pushing from
+# ten worktrees queue instead of running ten concurrent Astro builds and
+# thrashing the machine. Waiters block; they do not fail.
+set -euo pipefail
+
+root=$(git rev-parse --show-toplevel)
+cd "$root"
+
+# --git-common-dir resolves to the ONE shared .git across all worktrees, which
+# is exactly the scope we want the lock to cover.
+common=$(git rev-parse --git-common-dir)
+lock="$common/af-gate.lock"
+
+exec 9>"$lock"
+if ! flock -n 9; then
+  echo "gate: another worktree is running the gate — waiting for it…"
+  flock 9
+fi
+
+started=$(date +%s)
+step() { printf '\n\033[1m▸ %s\033[0m\n' "$1"; }
+
+# Fail loudly rather than passing vacuously when the toolchain is not installed.
+if [ ! -d node_modules ]; then
+  echo "gate: node_modules missing — run 'npm ci --prefer-offline' first" >&2
+  exit 1
+fi
+
+step "types"
+npx --no-install astro check
+
+step "build"
+npm run build
+
+step "content contracts"
+npm run verify
+
+# The assertion count is the thing agents are most tempted to "fix" downward.
+# Compare against origin/main and refuse a silent reduction.
+step "assertion coverage"
+current=$(grep -c 'throw new Error' scripts/verify.mjs)
+baseline=$(git show origin/main:scripts/verify.mjs 2>/dev/null | grep -c 'throw new Error' || echo "$current")
+if [ "$current" -lt "$baseline" ]; then
+  echo "gate: verify.mjs coverage fell from $baseline to $current assertions." >&2
+  echo "      Only verification-engineer may reduce it, with a reason per removal." >&2
+  echo "      See .agents/context/verification.md" >&2
+  exit 1
+fi
+echo "  $current assertions (baseline $baseline)"
+
+step "runtime dependency audit"
+node scripts/audit-ui.mjs
+
+step "design tokens"
+node .agents/scripts/check-tokens.mjs
+
+printf '\n\033[32mgate passed\033[0m in %ss\n' "$(( $(date +%s) - started ))"