chore: adopt the AGENTS.md convention (fold CLAUDE.md into AGENTS.md)

[kw-tmueller]

Brings this repo onto the AGENTS.md convention. Refs owncloud/admin#249.

AGENTS.md    100644   renamed from agents.md
CLAUDE.md    120000   symlink -> AGENTS.md

• The spec says uppercase AGENTS.md, and that is what agent tooling looks for — a lowercase agents.md is simply not found on the case-sensitive filesystems of our Linux CI runners.
• CLAUDE.md becomes a symlink to AGENTS.md, so Claude Code reads the same content and there is no second file to keep in sync.

This one was done by hand. The org-wide sweep (scripts/sync-agents-md.py in owncloud/admin) deliberately refuses any repo whose CLAUDE.md is a real file, because replacing it with a symlink would silently discard its content. Here that content has been folded into AGENTS.md first, so nothing is lost:

• Added Extension Anatomy (src/index.ts / defineWebApplication, vite.config.ts, l10n/, tests/), the extension-type registration table, and the key @ownclouders/* dependencies.
• Carried over the LLM proxy origin-validation security requirement verbatim — CORS headers alone are browser-enforced and insufficient, so ai-llm-proxy must check Origin against OCIS_URL server-side and return 403.
• Added the design-system and gettext rules, the Docker Compose / CSP step for new extensions, and the ocis.apps.yaml key-must-match-the-mount-target gotcha with both conventions spelled out.
• Added the per-package pnpm --filter commands, the Docker dev-environment and make l10n-* commands, and the Releasing section (per-app signed tags, pushed one at a time).
• Replaced the hardcoded package list, which had gone stale (9 entries for 25 actual packages), with a description of the groups plus "enumerate packages/ rather than trusting this doc".

Guidance that CLAUDE.md merely repeated from agents.md (OSPO policy, signed commits, DCO sign-off, Conventional Commits) was not duplicated.

One signed commit. Verify the symlink with git ls-tree HEAD — CLAUDE.md should be mode 120000 with a 9-byte blob.

Windows caveat: without core.symlinks=true plus Developer Mode, CLAUDE.md materialises as a one-line text file containing AGENTS.md. AGENTS.md itself is always correct, so nothing breaks.

🤖 Generated with Claude Code

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.