Bootstrap project and safe work-item workflow

AGENTS.md

@@ -0,0 +1,50 @@
+# Agent Instructions — Photo Analyzer
+
+Read `CLAUDE.md` and `INTEGRATED_PIPELINE_CONCEPT.md` before implementation. Preserve
+the established project invariants: never inspect or process content beneath any
+`_IGNORE/` directory; write verified EXIF before Immich upload; use managed
+`immich-go` uploads rather than External Libraries; keep operations resume-safe; and
+treat the existing CLI implementations as primary donors rather than rewriting them.
+
+## Mandatory implementation workflow
+
+When asked to start, resume, or continue implementation, work from this isolated Git
+repository and use `scripts/work-item`. Gitea issues and their dependencies are the
+authoritative backlog.
+
+1. Run `scripts/work-item claim`.
+2. Work only on the claimed story and its generated feature branch.
+3. Read the entire issue, linked specification, dependencies, and acceptance criteria.
+4. Inspect the legacy CLI donors before replacing applicable behavior. Update the donor
+   ledger and characterization tests required by the story.
+5. Implement every acceptance criterion and its automated tests.
+6. Run story-specific tests and the accumulated regression suite required by the epic.
+7. Run `scripts/work-item submit --test "<story-specific command>"` without `--yes` and
+   review the reported diff and file list.
+8. If the changes are correct and safe, rerun with `--yes`. This commits, pushes, opens
+   a pull request, records test evidence, and moves the issue to review.
+9. After review and successful CI, run `scripts/work-item complete --merge`. This
+   verifies the merge, closes the issue, returns to updated `main`, and removes the
+   local feature branch.
+10. Continue with the next eligible story by returning to step 1.
+
+If genuinely blocked, run `scripts/work-item block --reason "<precise reason>"` and
+stop. Never skip to a later story whose dependencies are open. Never mark work done
+when tests are missing, skipped, or failing.
+
+## Git and privacy safety
+
+- Never run automated Git operations from the personal photo-library directory.
+- Never stage or commit real photos, videos, `_IGNORE/` content, databases, logs,
+  credentials, environment files, caches, generated thumbnails, or runtime data.
+- Never use force-push, destructive reset, untracked-file deletion, or automatic merge
+  conflict resolution.
+- Do not bypass `scripts/work-item` safety checks or manually close implementation
+  issues to conceal a failed transition.
+- Preserve unrelated user changes and stop if the working tree is unexpectedly dirty.
+
+## Completion standard
+
+A story is complete only when its pull request is merged, required automated tests and
+CI pass, test evidence is recorded on the issue, the issue is closed with
+`status/done`, and the local repository is back on a clean, current `main` branch.