docs(agents): scope public outreach to authorized contributions

[jarbas-marco]

Delivers issue: #1581

Self-proposed documentation contribution for maintainer triage; not a claim that the issue has received the ready stamp. Closes #1581 if accepted.

Contribution rights

• Independent: I created this contribution, or otherwise have the right to submit it under Apache-2.0, and it is not owned or controlled by an employer, client, or other entity.
• Employer/client authorization required: An employer, client, or other entity owns or may control this contribution.
• Unsure: I need a private rights review before merge.

The human explicitly selected the independent path; the commit carries the submitting account's matching DCO sign-off.

Observation bundle

C1 — Desk-reviewed the exact AGENTS.md diff against fafd4ee. Private research now returns findings to its requester; the public issue/claim workflow applies when contribution and issue activity are authorized. Discord needs explicit authorization for that channel. Rights/DCO, worktrees, validation, maintainer gates and decision recording are unchanged.

Acceptance floor

Row	Evidence
A1	Research intake explicitly distinguishes private findings from authorized GitHub publication.
A2	Claiming and issue updates retain the contribution workflow; Discord authorization is stated separately.
A3	Rights/sign-off and all worktree, pre-push, validation and maintainer rules remain intact in the one-file diff.

Docs diff

Only AGENTS.md, the actor contract. No product-facing feature, API, architecture, license or deployment changes.

Validation and security

• git diff --check: passed.
• node scripts/gates.mjs all: exit 0 on ee400b0. Includes 14 Python packages, 18 Node package builds/tests, the real disposable Compose readiness proof, structural/security/license gates. Built-in opt-in/green-on-empty skips are unchanged; no live-meeting, stress or chaos run is claimed.
• Test-only environment: unavailable Redis on loopback instead of Docker DNS; loopback sockets excluded from the host proxy. No production services used, no gate assertions or code changed.
• Additional test-only setup: umask 022, Python bytecode disabled, required Alpine image installed, ephemeral Flows authentication generated in memory for a unique disposable Compose project. No credential values are included in this PR.
• No dependency or runtime code changes. No meeting, deployment or product-behavior claim.

Validation request

A non-author Vexa maintainer should desk-review the authorization boundary and confirm the contributor workflow remains intact. Maintainer triage, value validation and merge remain pending; no Discord outreach was performed.

Authorship

Submitted by jarbas-marco using agent assistance. No agent co-author trailers.

[github-actions]

👋 Thanks for opening your first PR to Vexa, @jarbas-marco!

Highly recommended (not required): hop into our Discord
and tell us in a sentence or two what this change does and why. It helps us review
your value bundle faster and connects you with the reporter and maintainers.

Your PR is judged on its evidence — the observation bundle + the diff — not on whether you
show up. But showing up makes the whole thing smoother. See
the delivery guide for how a PR reaches merge.

[github-actions]

🃏 Merge card — #1582

check		what it needs
Value	❌	missing state: value-signed (the value sign-off)
Diff	❌	no non-author approval on the current head sha (a new push dismisses a stale approval)
Acceptance	✅	every acceptance leg delivered on #1581

Not mergeable yet — every row above must be accepted before merge (choke point 1). Fill in what's ❌ above, then this clears automatically.

_{How a PR reaches merge: the merge bar.}