docs: add .agents workspace and the Astro refactor plan

Adds the agent-facing workspace and a 20-task plan for migrating the site
to Astro. Nothing here implements the refactor; these are briefs, rules and
templates that the task agents read.

- .agents/ holds context, rules, checklists, skills, specialist agents,
  component/page/config templates and gate scripts. It is vendor-neutral so
  MiniMax, Gemini and Codex can all read it; CLAUDE.md just points at
  AGENTS.md.
- .husky/ plus .lintstagedrc.json wire the three gate tiers. gate.sh locks on
  the shared git-common-dir so parallel worktrees serialise, and guards the
  assertion count in scripts/verify.mjs against a coverage drop.
- plans/astro-refactor/ carries the phase graph, per-task briefs and the
  model-routing recommendation.

These files must be tracked before fanning out: a worktree only checks out
tracked files, so an untracked plan is invisible to every agent working in one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

plans/astro-refactor/task-03-verification-net.md

@@ -0,0 +1,49 @@
+# Task 03 — Verification net
+
+**Agent**: `verification-engineer` · **Model**: Codex
+**Depends on**: 01 · **Parallel with**: 02, 04 · **Blocks**: 12–16
+**Worktree**: `.agents/scripts/worktree.sh start 03 verification-net`
+
+## Goal
+
+Rendered-text baselines for all ten routes, captured from the **vanilla site**,
+before any page is migrated. Without this the page migrators have nothing to
+diff against and "no content was lost" becomes an opinion.
+
+This task is on the critical path. Do it early.
+
+## Scope
+
+`.agents/snapshots/`, `scripts/audit-ui.mjs`, `.agents/scripts/visual-regression.mjs`.
+
+## Steps
+
+1. `npm run serve` against the **current, unmigrated** site.
+2. Snapshot all ten routes:
+   ```bash
+   for r in "" full-guide summary models agents skills rules skills-review \
+            hands-on/starter hands-on/rules; do
+     node .agents/scripts/snapshot-route.mjs "http://localhost:4173/$r/" \
+       > ".agents/snapshots/${r:-index}.txt"
+   done
+   ```
+   Commit them. They are the regression net.
+3. Write `.agents/scripts/visual-regression.mjs` (Playwright). Extend the
+   existing `scripts/inspect.py` pattern rather than inventing one. Baselines to
+   `.agents/snapshots/before/`.
+4. **Fix the audit gap**: `audit-ui.mjs` rejects external `<script>`/`<link>`
+   but misses external URLs in CSS — which is exactly how the broken Google
+   Fonts `@font-face` got into this "dependency-free" site. Add `@import`,
+   `src: url(https:…)`, `url(https:…)`.
+
+## Done when
+
+- [ ] Ten committed snapshots, each non-empty and containing that page's real prose
+- [ ] `visual-regression.mjs` captures 10 routes × 4 widths
+- [ ] Extended `audit-ui.mjs` **fails** on today's `styles.css` (prove it catches the real bug), then the dead rule is removed by task 02
+- [ ] `npm run gate` green
+
+## Do not
+
+Do not change any assertion in `verify.mjs` yet. That is task 19, after the
+pages exist.