docs: add CLAUDE.md agent guidelines for auth0-cli

[sanchitmehtagit]

Summary

Adds AI-agent guidelines for auth0-cli — a lean, guardrail-first CLAUDE.md plus a thin AGENTS.md that points to it, generated by the generating-claude-md skill and validated against the repo.

• CLAUDE.md (128 lines) — persona, working principles, project overview/structure, three-tier Boundaries, Security, and one-line anchors into references/.
• AGENTS.md — references @CLAUDE.md so non-Claude tools (Codex CLI, Gemini CLI) share the same guidance.
• references/*.md — full detail offloaded on demand: commands, testing, code-style, git-workflow, pitfalls, docs-update.

What detection surfaced (auth0-cli specific)

• Generated docs/ — produced by go run ./cmd/doc-gen, verified by make check-docs in CI. Command/flag changes must be accompanied by a make docs regeneration (never hand-edited). Captured as an Always-Do boundary + the code-to-docs mapping.
• Live-tenant integration tier — make test-integration needs real AUTH0_DOMAIN/CLIENT_ID/CLIENT_SECRET → Ask First; make test-unit is the safe default.
• CLI product analytics (AUTH0_CLI_ANALYTICS=false opt-out) + Sentry error reporting → documented in Security with the opt-out preserved.
• Secrets in OS keyring (internal/keyring) → "never log tokens" boundary.
• golangci-lint v2 with godot (period-terminated comments) surfaced as the CI-enforced style guardrail.

Validation

Filesystem validation pass: every cited path, every make target, and every references/*.md pointer verified to exist in the repo — no invented tooling.

Generated by the generating-claude-md skill.