AGENTS.md carries the owner's rules for every agent: commit identity, secret
handling, surgical edits, and writing style. PLAN.md is the owner's worklog and
is off limits to agents.
Directory skeleton from PLAN.md, plus a .gitignore that blocks .env files,
kubeconfigs, terraform state and sealed-secrets key backups. Empty directories
are held by .gitkeep so the layout survives a clone.
