docs(scanner): add AGENTS and log governance completion

src/Scanner/AGENTS.md

@@ -0,0 +1,36 @@
+# AGENTS · Scanner Module
+
+## Roles
+- **Backend / Analyzer Engineer**: .NET 10 (preview) for analyzers, worker, web service, plug-ins; keep outputs deterministic.
+- **QA / Bench Engineer**: Adds golden fixtures, regression tests, and perf/determinism benchmarks under `__Tests` / `__Benchmarks`.
+- **Docs Touches (light)**: Update module docs under `src/Scanner/docs` when behavior/contracts change; mirror in sprint notes.
+
+## Required Reading
+- `docs/README.md`
++- `docs/07_HIGH_LEVEL_ARCHITECTURE.md`
+- `docs/modules/platform/architecture-overview.md`
+- `docs/modules/scanner/architecture.md`
+- Current sprint file (e.g., `docs/implplan/SPRINT_131_scanner_surface.md`).
+
+## Working Directory & Boundaries
+- Primary scope: `src/Scanner/**` (analyzers, worker, web service, plugins, __Libraries, __Tests, __Benchmarks, docs).
+- Avoid cross-module edits unless sprint explicitly permits; note any cross-module change in sprint tracker.
+- Keep fixtures minimal/deterministic; store under `src/Scanner/__Tests/Fixtures` or `__Benchmarks`.
+
+## Engineering Rules
+- Target `net10.0`; prefer latest C# preview allowed in repo.
+- Offline-first: no new external network calls; use cached feeds (`/local-nugets`).
+- Determinism: stable ordering, UTC ISO-8601 timestamps, no `DateTime.Now`/random without seed; normalize path separators.
+- Logging: structured (`ILogger` message templates); avoid secrets/paths leakage.
+- Security: no executing untrusted payloads; keep analyzers pure; include redaction guidance for runtime capture adapters.
+
+## Testing & Verification
+- Default: `dotnet test src/Scanner/StellaOps.Scanner.sln`.
+- Add/extend tests in `src/Scanner/__Tests/**`; golden outputs should be deterministic (sorted keys, stable ordering).
+- Benchmarks under `src/Scanner/__Benchmarks/**`; document input and expected ceilings in comments.
+- Cover multi-RID, trimmed/NativeAOT, self-contained vs framework-dependent cases where applicable.
+
+## Workflow Expectations
+- Mirror task state in sprint tracker (`TODO → DOING → DONE/BLOCKED`); note blockers with the specific decision needed.
+- Keep resolvers/analyzers parametric on environment data (RID, TFM, search paths); avoid host-global state.
+- When adding DI/manifest registrations, ensure restart-time and worker compatibility; update module docs if contracts change.