CL-6509: Docs cleanup — sharpen AGENTS.md, fix stale DESIGN.md rail

[TheGreatAxios]

Summary

• AGENTS.md gains a "Conventions a check enforces" section: reportError from @corbits/error-sink, check:browser-safe-subpaths, check:tool-package-pins (and its known gap on src/ changing without a bump), check:licenses, and the exactOptionalPropertyTypes absent-vs-undefined gotcha. Also notes that a fresh worktree's packages/ is the source of truth, not node_modules, before bun install runs.
• Docs map now links PRODUCT.md/ARCHITECTURE.md/IMPLEMENTATION.md, which existed but weren't listed.
• DESIGN.md's footer-rail description was conditioned on Mission Control/Evals shipping "once it ships" — both have shipped, so the doc now describes the rail as it actually renders (/mission-control, /evals included).
• Checked VENDORED.md against current main: still accurate. The bearer-auth change to vendor/intx/hub-api is still an open PR (Workflow deploy: close the bearer-auth gap for agent-authored workflows #258), not merged — no ledger update needed yet.
• Packages named in the cleanup ask (walter-agent, loop-agent, lincoln-agent, agent-workflow-authoring, workflow-authoring-tools) are not yet on main (open PRs Port Walter, Loop, and Lincoln as default teammate agents #252, Agent-authored workflows: author + deploy as code #257) — intentionally left undocumented.

No wholesale rewrite, no new process, no aspirational rules — this only documents conventions already enforced by an existing check script or already true in shipped code, and cuts/sharpens stale text.

Linear: CL-6509

Test plan

• bunx prettier --check AGENTS.md DESIGN.md (already run locally, no diff)
• Docs-only change — no code paths affected