fix(pm): add a line ceiling for root AGENTS.md

[os-warren]

Fixes#9792

scripts/pm/check-skill-line-ratchet.mjs held per-file ceilings for every
.claude/skills/** instruction surface plus .claude/agents/os-dev.md, but root
AGENTS.md — the largest, most-read, most binding instruction file in the repo — had no
ceiling. That was the hole the oversized 39-line read-layer clause entered through before
it was compacted by #9715.

Change

Added a CEILINGS entry for AGENTS.md at its line count measured on fetched
origin/mainafter#9715 (e57524c, 2026-08-19T01:13Z) landed, which is confirmed to
still be the tip commit touching AGENTS.md:

$ git show origin/main:AGENTS.md | wc -l
958

958, headroom 0 — the same shrink-only convention every other entry in the map already
uses (lower freely; raising later needs a maintainer ruling quoted in the PR, per the
script's own header comment). Extended --self-test with a coverage case pinning that
AGENTS.md is in the map.

File surface is exactly scripts/pm/check-skill-line-ratchet.mjs, per the card.

Sequencing check (re-verified fresh, not taken from the card)

• git show origin/main:AGENTS.md | wc -l after a fresh git fetch origin main still
  shows e57524c as the newest commit touching AGENTS.md — no further AGENTS.md PR
  landed since the card was filed.
• Searched open PRs for AGENTS.md and for check-skill-line-ratchet: none open touch
  either file.

Gates — all at fac4602f3

$ pnpm check:pm-skill-ratchet
✓ check-skill-line-ratchet self-test: 13 cases pass.
...
✓ check-skill-line-ratchet: AGENTS.md is 958 lines (ceiling 958; headroom 0).
$ pnpm check:cross-package-test-inputs
All 33 self-test cases passed.
OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
$ pnpm check:nul-bytes
✓ check-nul-bytes --self-test: 75 assertions over a temp git repo (real scan() path)
check-nul-bytes: OK (scanned 6278 text file(s) -- 6278 tracked, 0 untracked-not-ignored; skipped 5 binary; no raw ASCII control bytes).

Gate union re-derived from the real diff (node scripts/pm/dispatch-gates.mjs, no paths
passed — script derives the change set from merge-base itself):

Local gates for this card:
- pnpm check:cross-package-test-inputs [lint.yml] matched via scripts/pm/check-skill-line-ratchet.mjs ⇢ gate source 'scripts/**'
- pnpm check:pm-skill-ratchet [lint.yml] matched via scripts/pm/check-skill-line-ratchet.mjs ⇢ gate script 'scripts/pm/check-skill-line-ratchet.mjs'
- node scripts/check-cross-package-test-inputs.mjs [ci.yml] matched via scripts/pm/check-skill-line-ratchet.mjs ⇢ gate source 'scripts/**'

Re-ran the full union again after the final commit (fac4602f3) — same three families,
all green, byte-identical set to the pre-commit run.

scripts/ only, nothing published: no changeset.

---

Generated by Claude Code