docs: add .github/copilot-instructions.md and require mirroring into it

[cliffhall]

Closes #1877

GitHub Copilot reads .github/copilot-instructions.md when it reviews a PR. We didn't have one, so Copilot has been reviewing against generic defaults rather than this codebase's actual (and unusually specific) conventions.

The file

A review-focused distillation of AGENTS.md — the rules a reviewer would cite against a diff:

• TypeScript — no any, no suppressing error types in config, no @ts-nocheck/@ts-ignore, and the double-cast rule including when an as unknown as is acceptable (documented third-party type gap or structurally-identical shapes) and that it must carry a justifying comment.
• React/Mantine — dumb components, the props → theme variant → CSS class preference order, no inline styles, no raw color literals, what may live in App.css at all.
• The .withProps() rule in full, including the part most often missed — single-use elements are not exempt — the static-vs-dynamic distinction (content/accessibility literals don't count toward the two), and all five legitimate exceptions (Box, Accordion, headless components, data-*, non-factory components).
• Theme files vs. element components — and that domain variant logic must never go into a theme file.
• lib vs utils, the one-way import direction, and the warning that the coverage include is a whitelist, so a module outside the named directories silently escapes the gate.
• Tests — the ≥90% four-dimension gate, the v8 ignore policy that forbids lowering it, test placement (web side-by-side vs. __tests__/ for the Node clients), and the mandatory renderWithMantine.
• Gates and PR hygiene — npm run ci before pushing and why validate isn't a substitute, Closes #N, exactly one version label.
• A "what to prioritize" list that puts correctness and security first, noting this backend spawns local processes and proxies outbound requests, so auth / origin validation / host binding / the proxy's SSRF controls deserve the closest reading.

Deliberately excluded: board recipes and IDs, milestone and branch-naming mechanics, release and publishing procedure, and the project-structure tree. No reviewer cites those against a diff, and copying them would double the maintenance surface.

The AGENTS.md amendment

"Keep documentation files up to date" now requires mirroring review-relevant changes into copilot-instructions.md in the same PR, and:

• states plainly that AGENTS.md remains the source of truth — never edit the mirror alone to change a rule;
• defines what counts as review-relevant, so the rule is actionable rather than a judgment call each time;
• lists what is deliberately not mirrored, so nobody "helpfully" copies the board recipes in later;
• says to keep it a distillation, since the file is read on every review and length has a cost.

Known weakness, stated rather than hidden

Nothing detects drift between the two files — there's no generation step and no CI check. The mirroring rule is the only thing keeping them in sync, and a stale mirror is worse than no mirror, because Copilot would then review confidently against rules we no longer hold. The file's own header says AGENTS.md wins on any disagreement and that drift is itself worth flagging in review. If it drifts in practice, the follow-up is a CI check that fails when AGENTS.md's review-relevant sections change without a corresponding mirror change — which is why the rule reads "same PR" and not "eventually."

Testing

Docs only — no gate reads either file (format:check globs cover {ts,tsx,mts,cts,js,jsx,mjs,cjs}, not .md). npx prettier --check .github/copilot-instructions.md passes anyway, since it's a new file.

Not verified from here: whether Copilot actually picks the file up on the next review — worth eyeballing on the first PR after this merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

[cliffhall]

Folded into #1866 — same commit, cherry-picked cleanly.

Consolidating so there's one modification to AGENTS.md across this batch of PRs rather than two touching different sections of the same file. #1866 now closes both #1873 and #1877.

Nothing is lost: the commit docs: add .github/copilot-instructions.md and require mirroring into it is unchanged, and the copilot-instructions detail from this description is now a section in #1866's.