chore: AGENTS.md, a required build check and CODEOWNERS

[modelmirror-agent]

Sets the site up to be worked from agent sessions under a PR-and-approval flow, without a staging branch.

What changed

• AGENTS.md (and CLAUDE.md, which imports it) covers:
  • the site computes nothing and states only what fedcourtsai states, so figures and results come from the fetched data, never typed in;
  • branch, PR to main, maintainer approves and merges, and agents never approve;
  • interactive sessions act as modelmirror-agent;
  • the local gate is npm ci && npm run build;
  • workflow, secret and identity conventions;
  • a matching PR here when a fedcourtsai change alters what the fetch scripts read.
• .github/workflows/build.yml runs npm ci and npm run build on PRs into main and on main. That is the same build Cloudflare Pages runs, prebuild fetches included. It has contents: read, no secrets, and pinned actions (checkout v7.0.1, setup-node v7.1.0 with .nvmrc and the npm cache).
• .github/CODEOWNERS is * @modelmirror. It requests your review on every PR automatically, so each one notifies you.
• README gets one line on the check and on AGENTS.md.

Checks run

• Build: npm ci && npm run build passes in the session (12 pages, including the fetches from fedcourtsai).
• Linters: actionlint 1.7.12 is clean. zizmor 1.26.1 (--offline --persona=regular) reports no findings.

Ruleset for main (maintainer, after this merges and build has reported once)

This is one ruleset, named something like main: require PR, targeting the default branch:

• Restrict deletions and Block force pushes.
• Require a pull request before merging:
  • 1 approval, with Required reviewers set to the maintainers team, pattern *. The team needs direct access to this repository first.
  • Dismiss stale approvals on.
  • Most-recent-push approval off.
  • Merge methods: squash and merge.
• Require status checks to pass: build. GitHub only offers it once it has run here, which is why the ruleset comes after this PR.
• Bypass: Repository admin role, pull requests only, so your own PRs merge through a recorded bypass. No App needs a bypass: nothing commits to main automatically, and rebuild.yml only calls the deploy hook.

Effect check

• The next agent PR shows Review required and a build check.
• An agent can't merge into main.
• Cloudflare Pages still deploys main after a merge.

Merge: this one is yours to merge; it adds a workflow and sets the review rule.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XJh29KatNYYsF9Bh1XW3C5

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying fedcourtsai with    Cloudflare Pages

Latest commit:	ba3bfe8
Status:	✅  Deploy successful!
Preview URL:	https://c3e2ede6.fedcourtsai.pages.dev
Branch Preview URL:	https://chore-agents-and-ci.fedcourtsai.pages.dev

View logs