docs: teach the stack the repositories actually run, and add AGENTS.md

[fmind]

What

Rewrites the chapters that described the previous stack, and adds the AGENTS.md coverage the course never had.

Why

• Chapter 4.4 taught trivy config . — which silently defers to a TRIVY_CONFIG environment variable and runs only one of the four scanners trivy.yaml declares.
• Several chapter-4 pages told readers to install tools with uv add --group check, while all four repositories use a single dev group. Following the course literally produced a project whose uv sync omitted ruff and ty.
• Chapter 5.3 reproduced the package's ci.yml verbatim, including the git diff --exit-code assertion that has since been replaced.
• Chapter 5.1's task table listed a watch task the package does not define, and omitted all.
• The course had zero coverage of AGENTS.md while all four repositories ship one.

How

• 6.2 now covers AGENTS.md properly: what the format is and that the Agentic AI Foundation stewards it under the Linux Foundation, the README-for-humans / AGENTS.md-for-agents split with a comparison table, what belongs in each, a complete skeleton, the boundary where its authority stops (it guides, it does not enforce), and the anti-drift lesson from the vendored skill copies the package used to ship.
• 5.1 documents all as the named gate, mise.lock, and run_auto_install = false.
• 5.2 explains why the hook priorities jump by ten (lefthook orders alphabetically) and the three-tier secret scan.
• 5.3 carries the real hardened workflows, why the job is named checks, why the porcelain assertion beats git diff, that a job-level permissions: block replaces rather than merges, and a new section on linting workflows with actionlint and zizmor.
• 5.4 wires hadolint to check:dockerfile.
• 5.5 / 5.6 teach MLflow on SQLite — including that MLflow 3.14 already defaults to it — and the session-scoped migrated-database fixture.
• 4.1 / 4.2 / 4.4 / 4.5 cover Ruff 0.16, the coverage gate, and the corrected security tooling.

Also pins the security workflow runner to ubuntu-24.04 so it matches CI.

Test plan

• mise run all — exit 0; mkdocs build --strict green with no WARNING or ERROR lines.
• A separate review pass re-verified every command, flag, path, task name, and version literal in the diff against the reference repositories, and fixed nine defects: two wrong claims about mise reading .python-version (it does not by default — uv does), a wrong dependency-bump count, an off-by-one rule-family count, a task-table row missing a check, an abridged AGENTS.md quote that contradicted two other chapters, a fabricated line number in tool output, and two cross-chapter contradictions in 6.3.