fix(ci): re-commit go.work + go.work.sum — required by module hygiene job

The 'chore: reorganize repo' commit removed go.work / go.work.sum and
added them to .gitignore. CI's 'module hygiene' job was designed
around the assumption that go.work is committed: it runs 'go work sync'
then 'go build -mod=readonly', and a separate step greps go.work for
each ./external/{eyrie,inspect,sight,tok,trace,yaad} path. Without
the committed file, both 'go work sync' and the build fail.

Also updates AGENTS.md to reflect that go.work IS committed, and
replaces the .gitignore comment with a pointer to the CI workflow.

Author: Patel230

.gitignore

@@ -53,6 +53,8 @@ testdata/compat-test
 bin/
 .shared-templates/
 
-# Go workspace (local dev only — not committed per AGENTS.md)
-go.work
-go.work.sum
+# Go workspace is committed because CI's `module hygiene` job runs
+# `go work sync` + `-mod=readonly` build and asserts no diff against
+# the committed files. See .github/workflows/ci.yml.
+# (go.work.sum.hawk/ is a per-test artifact and stays ignored.)
+go.work.sum.hawk/

AGENTS.md

@@ -150,7 +150,10 @@ test: add coverage for guardian
 - Do not import `internal/` from other ecosystem repos — use `shared/types/`
 - Do not put API keys in `.env` or shell env for hawk — use `/config` (OS keychain)
 - The `external/` directory is for local dev only; CI clones repos separately
-- `go.work` is for local multi-repo development; it is not committed
+- `go.work` and `go.work.sum` are committed — CI's `module hygiene` job
+  runs `go work sync` and asserts the result is in sync with the repo. Both
+  files point at `./external/*` checkouts; the `.github/actions/checkout-eyrie`
+  action populates `./external/` on CI runners before the build runs.
 
 ## Naming Conventions
 

go.work

@@ -0,0 +1,11 @@
+go 1.26.3
+
+use (
+	.
+	./external/eyrie
+	./external/inspect
+	./external/sight
+	./external/tok
+	./external/trace
+	./external/yaad
+)