docs(agents): add NON-NEGOTIABLE session-start check-for-understanding gate

Codify the orientation checkpoint in Quick Start so every session begins
with the agent summarizing all rules and waiting for user confirmation
before any task work. Portable (AGENTS.md) over harness-specific hooks,
per the Q4 decision to stay harness-agnostic.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

AGENTS.md

@@ -81,12 +81,26 @@ traceable to an approved ticket. There is no "I thought it would help."
 
 **You are an AI agent working on this project. Your first actions, in order:**
 
+> **SESSION-START GATE (NON-NEGOTIABLE):** Steps 1-3 orient you. Step 4 is the
+> check-for-understanding gate. You MUST NOT begin any task work (steps 5+)
+> until the user confirms your rule summary is correct. This runs **every
+> session, automatically** — the user should never have to ask for it.
+
 1. **Set up the environment:** `bash scripts/setup-hooks.sh` (installs git hooks — idempotent).
 2. **Read this file** (`AGENTS.md`) — project policy and domain knowledge.
 3. **Read [questions-v1.md](questions-v1.md)** — open questions awaiting human input.
-4. **Check Redmine** — `docker run --rm --env-file ~/.creds/redmine.env git.knownelement.com/reachableceo/redmine-cli:latest list --assigned-to-me -p 55` for active work.
-5. **Check current state:** `git log --oneline -10`.
-6. **Run rule audit:** `bash scripts/check-rules.sh --fast`.
+4. **Check for understanding — GATE.** In your own words, summarize ALL the rules
+   back to the user before doing any work: Agent Authority (ticket-governed,
+   propose-never-implement), Access-Channel SSH-only policy, Questions policy
+   (no harness question-tools), Documentation policy (Discourse is SoR),
+   Redmine tracking, Git policy (always commit+push, shellcheck), Mandatory
+   infra-change documentation (#298 audit log), SSH routing chokepoints
+   (`tests/remote.sh`), the mechanically enforced `check-rules.sh` rules, and
+   Credentials (Vault migration TODO). Then stop and wait for the user to
+   confirm. This checkpoint guarantees every session starts aligned.
+5. **Check Redmine** — `docker run --rm --env-file ~/.creds/redmine.env git.knownelement.com/reachableceo/redmine-cli:latest list --assigned-to-me -p 55` for active work.
+6. **Check current state:** `git log --oneline -10`.
+7. **Run rule audit:** `bash scripts/check-rules.sh --fast`.
 
 ## Enforcement Model