Add the Touch ID review lessons to AGENTS.md and CONTRIBUTING.md - #14

@scottjones good idea to write these down; lines 26 and 28 are precise and fit the file. A few wording fixes so agents don't over-apply them:

• Line 20 (udev add → pacman hook) is too broad. It would also cover 70-omarchy-mac-external-displays.rules, whose add must only run while the boot splash is up, and change actions that must not be replayed. Suggest: "A udev add action that must reach a device already present also gets a pacman hook that does that work on install and upgrade; the hook exits 0 in a chroot or an unbooted root, and never fails the transaction. An add that should only run when the device appears does not."
• Line 25 ("never read … /sys") reads as a ban on all /sys reads, while existing tests already point copies at /sys fixtures. Suggest "never the host's /usr/share/omarchy-platform, installed omarchy-* commands, /sys or running services: stage into a temporary root and point copies at fixtures."
• Line 21 ("a step the owner sees only once") also covers first boot, which already belongs to the installer. "An invitation the owner sees only once ships only after everything it leads to is published" says what was meant.
• Line 27 ("don't skip") sits next to the existing skip when OMARCHY_TEST_RUNTIME is unset. Say it's about the pin: "moves test/integration/runtime to that commit; it does not skip because that pin lacks it."

@maralcbr thanks, applied all four in 0fc00085.

Thanks @scottjones, the rules capture real lessons from the Touch ID work. One change before merge:

• Line 25: please reword to "stub external dependencies, keeping the real commands under test". As written, "stub the runtime's commands" contradicts how the integration tests work.

Smaller things:

• "Invitation" isn't defined anywhere else in the repo, so an agent can't act on that rule. A short definition (or a pointer to the fingerprint-setup offer it refers to) would fix it.
• The PR description no longer matches the diff; worth a refresh.

With the line 25 fix in, this is good to merge from my side.

Thanks @scottjones, the line 25 fix and the invitation definition are in. A few things left, all wording or timing:

• Line 21 names omarchy-hw-fingerprint and fingerprint-readers, which only arrive with Name Touch ID as a fingerprint reader and wake it at boot #12. Either merge this after Name Touch ID as a fingerprint reader and wake it at boot #12, or say where they come from. "Published" is also open to reading as merged; suggest "published to the repositories Macs update from".
• Line 25: the systemd-analyze verify --root sentence is unconditional, but existing tests differ: omarchy-mac-boot/test/mac-external-displays-test.sh:170 verifies without --root and skips when the container cannot verify units, and mac-hid-initramfs-test.sh:353 uses --root on the extracted initramfs. Suggest "where the container can verify units, run it with --root at the staged tree".
• Line 27 (nit): "moves test/integration/runtime to that commit" can read as the exact commit that gained the feature, while the pin is a reviewed commit (today #13362's head). "to a commit that has it" is clearer.
• The PR description still shows the old diff; worth a refresh.

Line 21 is also a release gate not written down in CONTRIBUTING.md; I'm happy to adopt it, just flagging that merging this makes it policy.

@maralcbr thanks for this, and sorry for the slow reply. All five are in:

• Line 21: it now says "published to the repositories Macs update from" (86eef55). The last sentence says where each piece comes from: Name Touch ID as a fingerprint reader and wake it at boot #12 adds fingerprint-readers to omarchy-mac's platform files, and Find fingerprint readers a platform names omarchy#14675 teaches the runtime's detector, omarchy-hw-fingerprint, to read it (7e514c4). That way Add the Touch ID review lessons to AGENTS.md and CONTRIBUTING.md #14 doesn't have to wait for either. If #14675 renames the file or the detector in review, I'll follow up on line 21.
• Line 25: taken as you suggested (86eef55). mac-external-displays-test.sh:170 still verifies without --root; I'll fix that in a separate PR rather than grow this one.
• Line 27: taken, "to a commit that has it", and "the current pin" (86eef55).
• Description: refreshed after 86eef55, and again for 7e514c4.
• Release gate: happy to make it policy, so it's written down now. 7e514c4 adds it to CONTRIBUTING.md under Pull requests, next to the cold-boot evidence rule.

Could you take another look when you get a minute? It still needs an approval before it can merge.