docs(agents): add no-direct-DB-access rule — API-first always

If a tool has an API, use it. Exhaust all API endpoints before
considering direct DB access. DB schemas change without warning;
APIs are the stable contract. Aligns with upcoming zero trust
proxy migration.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

AGENTS.md

@@ -53,6 +53,13 @@ There are no exceptions to this rule.**
    usable. The agent MUST NOT set done-ratio to 100%, MUST NOT suggest
    closing, and MUST NOT move to the next ticket until the user explicitly
    accepts the work. "Technically wired but blank dashboard" is NOT done.
+9. **NEVER access a database directly if an API exists.** APIs are the
+   stable contract; databases change schemas without warning. If a tool
+   has an API, use it — exhaust all API endpoints, check the docs, try
+   alternative methods. Only fall back to direct DB access as a last
+   resort AND with explicit user approval for that specific instance.
+   Soon all DB access will route through a proxy under zero trust;
+   building API-first habits now ensures that transition is clean.
 
 ### Access-channel policy: SSH only (NON-NEGOTIABLE)