[Blind-Striker]

Summary

Agents working in this repo stopped too often to wait for instructions. This PR replaces the category-based approval gate with an autonomy rule and makes AGENTS.md its single owner.

• New AGENTS.md → Autonomy And Approval: agents carry the requested goal through to verified completion, making the code/test/build/CI/CDK/doc changes it needs without asking. They ask first only before destructive or outward-facing actions: AWS mutations and deploys, push/PR/release, history rewrites or discarding others' work, weakening or deleting tests, and loosening the safety rules. When one of those comes up, they finish everything else first and ask once at the end. Commits happen only when requested.
• Single owner: workflow.md, slop-review.md, testing-style.md, quality-gates.md, local-development.md and security-and-storage.md had their own (sometimes stricter) copies of the gate. They now link to AGENTS.md#autonomy-and-approval.
• Deviation protocol: Level 2/3 findings no longer halt the session. The agent leaves the affected scope unchanged, finishes the independent work and ends with the evidence and a proposal. Documentation-only corrections are made directly.
• Handoffs end with a default next step instead of "talk to Deniz before committing to which one".
• Cleanup:
  • CLAUDE.md now imports @AGENTS.md. A plain Markdown link is not loaded by Claude Code.
  • The .claude skill shim's description was copied from the Aspire.Hosting.LocalStack repo and now describes BadgeSmith.
  • Cloning external/ source checkouts no longer needs approval.
  • Local Native AOT release builds no longer need approval.
  • The Copilot relay and the stale marketplace/LSP references are removed.
• AGENTS.md shrinks from 135 to 111 lines. Always-On Safety is unchanged.

Verification

• git diff --check is clean.
• A repo-wide Markdown link and anchor check finds no broken targets.
• The remaining "approval-gated" wording refers only to deploy and AWS mutation, which this PR keeps as ask-first actions.
• Docs-only change, so no build or test was run locally. CI build-and-test runs on this PR.