[Pepps233]

Summary

Reject AGENTS.md in reviewed release archives, including case variants, bundled workspaces, and nested archives.

The published @diffexai/diffex@0.2.1 tarball already contains no such file; this closes a missing enforcement check for future artifacts.

Reasoning

Repository instructions must not ship in the installable CLI.
Four contaminated archive regressions passed the previous release gate, demonstrating that the existing package inventory checks did not enforce that requirement.
The existing recursive archive gate now rejects these files before publication while permitting documentation about user-owned context files.

Changes

• Reject case-insensitive AGENTS.md path components in the release payload checker.
• Cover root, documentation, bundled workspace, and nested archive payloads.
• Preserve normal documentation mentioning AGENTS.md and user project context loading.

No runtime behavior, dependencies, package versions, or published artifact bytes change.
Live credential verification and the unresolved npm HTTP 400 are recorded separately in diffex-cloud#161.

Testing

• npm run check passed after supported model-data hydration.
• node --test scripts/distribution-payload.test.mjs scripts/prepare-distribution.test.mjs passed all 26 tests.
• The four new rejection cases failed before the guard and passed after it.
• All 239 script tests passed during the broader test run.
• The exact published 0.2.1 tarball passed scripts/check-distribution-payload.py with the new guard.
• ./test.sh completed with one fresh-checkout setup failure: the fs.watch subprocess regression needed compiled packages/tui/dist files.
  Generated that dependency with node_modules/.bin/tsgo -p packages/tui/tsconfig.build.json, then reran test/suite/regressions/2791-fswatch-error-crash.test.ts from the coding-agent package: passed.
  All other workspace suites passed; credential-dependent tests remained skipped by the isolated test harness.