chore: add information-exposure policy for public repo

[mykhaylob-de]

Summary

Adds an information-exposure policy for agents working in this public repository: a canonical AGENTS.md (read natively by Cursor, Claude Code, Codex, and other agent CLIs) plus a thin always-applied Cursor rule that enforces the hard bans inline and points to AGENTS.md for the full policy.

Changes

• AGENTS.md — canonical policy: no internal content (tickets, Slack, customer/org names, employee emails, internal URLs/hostnames/infra) in commits or PRs; neutral security wording; absolute ban on secrets in messages, code, examples, and HTTP fixtures; no AI/agent attribution; same rules for comments, docstrings, error strings, CHANGELOG, and example data.
• .cursor/rules/info-exposure.mdc — alwaysApply: true summary of the four hard rules, referencing AGENTS.md.

Test plan

• Prose/config only — no runtime code changed
• .mdc frontmatter matches the format used by existing Cursor rules

[Warkanlock]

Verdict: Reviewed information-exposure policy and agent guidelines for public repository. Both files establish clear rules for commits, PRs, code, and fixtures: no internal content (tickets, customer names, employee emails, internal URLs), no security details in commit text, no secrets anywhere, and no AI attribution trailers.

These are advisory rules documented in .cursor/rules (scanned by Cursor IDE) and AGENTS.md (human-readable). The policy is well-scoped and unambiguous. Residual risk: enforcement depends on code-review discipline and maintainer adoption — no automated CI hook or git hook blocks a violation at commit time. Recommend adding a pre-commit hook or CI check to scan for common patterns (hardcoded tokens, internal domain names, ticket IDs) if this becomes a recurring issue.

[Warkanlock]

Not actioned — residual pre-commit/CI scanner is out of scope for this docs-only PR. Policy is advisory by design; a hook can land later if violations recur.