docs(framework): complete TSYSGroupAIOS adoption + tracker/IaC rules [#454]

Bring the framework's global baseline (BASELINE-PROMPT.md, PATTERNS.md,
ADOPTING.md) into the repo — AGENTS.md referenced them but the files were
missing. AGENTS.md gains three rules adopted this session: TDD & Linting
(mandatory at the Ansible/IaC transition), IaC codification shadow-tracking
(every manual fleet change same-day ticketed to #454), and Redmine tracker
discipline (Support not Bug — the CLI default created nine misfiled
tickets, now corrected). Q10 records the direct-push vs PR conflict for
the founder to rule on.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

AGENTS.md

@@ -209,6 +209,9 @@ for the human's situational awareness during the session.
 - **Stop over-thinking.** Get to code and output faster. Explore with code;
   gather ground truth. Do not burn tokens reasoning about things a quick command
   answers.
+- **Prefer Unix utilities** (awk, sed, grep, cut, tr) for file editing and
+  text processing over harness edit tools when feasible — deterministic and
+  exact where harness editors can be whitespace-fragile.
 - **Farm work out to deterministic tooling:** linters, LSPs, formatters, test
   runners. If an LSP is wired up, use it; otherwise pull a Docker image and lint
   inside it.
@@ -331,11 +334,39 @@ vendor/             Vendored KNELShellFramework
    justification. A script that emits any diagnostic is a protocol violation.
    Non-bash scripts (PHP with `.sh` shebang `#!/usr/bin/php`, etc.) are exempt.
 
+## TDD & Linting
+
+- **Red/green TDD for all code.** Mandatory (founder 2026-08-27). Interim
+  relaxation applies ONLY until the Ansible/IaC transition (week of 9/1);
+  from then on every playbook/script ships with its failing test first.
+  `scripts/test.sh` is the local gate; `tests/validation` + `tests/security`
+  run on sectestbed targets.
+- **Linters on all code, as early as possible.** shellcheck zero-warning
+  (including info-level) is already enforced pre-commit.
+
+## IaC Codification (shadow tracking) — NON-NEGOTIABLE
+
+**Every manual/direct change to a fleet system must be codified same-day as
+an AWX playbook item.** The fleet converges to 100% IaC (founder mandate,
+2026-08-27, #454).
+
+- Made a manual change? Add a checklist item to #454 (or a child ticket) in
+  the same session — what changed, where, exact commands, and any quirks
+  (e.g. "needed udevadm trigger after NUT install").
+- Work is NOT "done" until the manual change is codified or explicitly
+  ticketed for codification.
+- New manual fixes during incidents: fix first, codify immediately after.
+- Playbooks live in this repo, tested through the `sectestbed-*` fleet.
+
 ## Redmine Tracking Policy
 
 **Redmine is the system of record for all work.** Do not track status,
 checklists, or TODOs in repo files. Use Redmine tickets instead.
 
+**Tracker discipline:** OAM/ops/feature/audit tickets use tracker **Support
+(3)** — NOT Bug. The redmine-cli `create` defaults to Bug; always correct the
+tracker after create (python escape hatch: `tracker_id=3`). [2026-08-27]
+
 - **URL:** https://projects.knownelement.com
 - **Version:** Potential to Kinetic Ready (due 2026-09-30)
 - **Project:** Known Element Enterprises - Technology & Facility Services (id 55)