docs(agents): never commit review artifacts to a contributor's fork

[vsits-proxy-builder]

Problem

AGENTS.md told the review agent to commit PR review artifacts "on the PR branch," without qualifying who owns that branch. On a community PR from a fork, following that instruction literally means pushing to the contributor's branch — and that is what happened this week on #274 (Gunther-Schulz:pr/header-propagation) and #277 (Gunther-Schulz:pr/graceful-stop). Both pushes have been reverted; the branches are back to the contributors' own commits, and an apology is posted on #274.

The agent was following our documented rule. The rule is the defect.

Why it matters beyond etiquette

maintainerCanModify: true makes the push mechanically possible on most community PRs. It is not permission — a contributor's branch is theirs, and a force-visible history rewrite can land on top of local work they have in flight.

It also backfires mechanically. This repo dismisses stale reviews on push, so the review-doc commit dismisses the very approval it documents, and any approved-by-* label instantly goes stale against the new head. Both #274 and #277 ended up with a DISMISSED approval and a stale approval label as a direct result.

Change

Fork PRs get no committed artifact — the formal gh pr review body is the artifact. Org-owned PR branches are unchanged. Adds an explicit pre-write check (gh pr view <N> --json headRepositoryOwner).

Non-Functional Requirements

• Size/complexity budget — 22 lines of documentation, one file. No code.
• Threat model — n/a. Documentation only; no inputs, no trust boundaries, nothing on the wire.
• Maintainability constraints — no new abstraction; narrows an existing rule and states the reason so it is not "simplified" back later.
• Performance/reliability — n/a.
• Load-bearing? No. Documentation governing agent behavior. It touches no shared abstraction, wire contract, or schema.

Testing

Documentation only — no test surface. Verified the two affected fork branches are restored to their contributors' commits (4f2eb482 on #274, c814fd2f on #277).

Note on the pre-push hook

The pre-push guard flagged path leaks and was overridden with GIT_PUSH_GUARD_ALLOW=1. Every match is in pre-existing main history (older docs/code-reviews/ artifacts carrying absolute paths), not in this commit. git log origin/main..HEAD is a single commit and it contains no paths, hostnames, or addresses. This is the documented rebase-range case.

— Proxy Builder