docs: point mandatory first actions at reproducible setup script

A freshly-cloned repo previously required hand-rolling the dev
environment. Onboarding is now a single command, so AGENTS.md's
mandatory first-actions and startup section now call
./scripts/setup-dev-environment.sh (which also configures git hooks)
instead of the bare setup-githooks.sh step.

Also adds an explicit "Auto-Commit & Auto-Push (NON-NEGOTIABLE)"
note at the top so agents never wait to be asked before committing
and pushing each logical change.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

AGENTS.md

@@ -5,10 +5,23 @@
 **You are an AI agent (Crush) working on this project.**
 
 ### Your First Actions (MANDATORY)
-1. **Read STATUS.md** - Check current project status (build state, blockers, next actions)
-2. **Read docs/SDLC.md** - **CRITICAL**: Understand the MANDATORY development workflow
-3. **Read docs/PRD.md** - Understand requirements (source of truth)
-4. **Check current state**: `ls -lh output/` and `git log --oneline -10`
+1. **Run `./scripts/setup-dev-environment.sh`** - Reproducibly set up the whole dev environment (Docker image, git hooks, VM tooling, smoke test). Idempotent; safe to re-run. Requires sudo for the VM tooling installs. Use `--skip-vm` for a build/test-only environment
+2. **Read STATUS.md** - Check current project status (build state, blockers, next actions)
+3. **Read docs/SDLC.md** - **CRITICAL**: Understand the MANDATORY development workflow
+4. **Read docs/PRD.md** - Understand requirements (source of truth)
+5. **Check current state**: `ls -lh output/` and `git log --oneline -10`
+
+### Auto-Commit & Auto-Push (NON-NEGOTIABLE)
+
+**You MUST commit and push AUTOMATICALLY as you work. NEVER ask the user for permission. NEVER wait to be asked.**
+
+- Commit after EVERY logical change (one atomic commit per change)
+- Push immediately after every commit (`git push origin main`)
+- Do not batch unrelated work into one commit
+- Never leave uncommitted/unpushed changes at the end of a session
+- If a step is blocked, commit and push the work that IS done, then report the blocker
+
+This is reinforced in detail in the "AUTO-COMMIT & AUTO-PUSH IS MANDATORY" section below.
 
 ### Use Sub-Agents Liberally (MANDATORY)
 
@@ -139,7 +152,7 @@ A pre-commit hook automatically enforces SDLC requirements:
     └── security-model.md
 
 src/                       # Source scripts
-scripts/                   # Utility scripts (setup-githooks.sh)
+scripts/                   # Utility scripts (setup-dev-environment.sh, setup-githooks.sh)
 githooks/                  # Shared git hooks (pre-commit)
 config/                    # Configuration files
 ├── includes.installer/    # Installer configs (preseed.cfg)
@@ -157,8 +170,9 @@ output/                    # Build artifacts
 
 ### 1. Start Up
 ```bash
-# Configure git hooks (if not already done)
-./scripts/setup-githooks.sh
+# Reproducible dev environment setup (Docker image, git hooks, VM tooling, smoke test).
+# Idempotent; requires sudo for VM tooling. Skip VM tooling with --skip-vm.
+./scripts/setup-dev-environment.sh
 
 # Check current state
 ls -lh output/