docs(agents): mandatory pre-flight + forbidden-commands warnings for dirty trees

[fglock]

Summary

AGENTS.md already warned about git stash, but said nothing about
git checkout <path>, git restore, git reset --hard, or
git clean — which are equally destructive when run on a dirty
working tree. This gap caused a real data-loss incident on
2026-04-28, where ~600 module results from cpan_random_tester.pl
were silently destroyed by an agent running
git checkout dev/cpan-reports/.

This PR makes the rules harder to ignore:

1. MANDATORY PRE-FLIGHT block at the very top: the exact `git diff

   /tmp/wip-*.patch+ WIP-branch commit commands an agent must run the momentgit status` shows unstaged work it didn't create.

2. FORBIDDEN COMMANDS ON A DIRTY TREE block enumerating each
   destructive verb (checkout <path>, restore, reset --hard,
   clean -fd, stash) with the safe alternative (mv aside, then
   git show HEAD:path).
3. Incident Log table: each new incident appends a row in the same
   commit that fixes it, so future agents can see the warnings are
   tied to real failures rather than abstract caution.
4. Top-of-file note telling readers the warning blocks document real
   losses.

The two existing rules already in AGENTS.md (the git stash warning
block and the "save with git diff > backup.patch" guidance under
"How to Check Regressions") are preserved verbatim.

Test plan

• make passes locally (BUILD SUCCESSFUL, parallel unit tests green)
• Documentation-only change; no runtime impact

Generated with Devin