docs: add upstream submodule cutover plan, README guidance, and AGENTS.md

[jooh]

Motivation

• Consolidate upstream TypeScript sources under the upstream/ git submodule so the repo can target a pinned upstream commit as the compatibility baseline.
• Prevent accidental duplication of upstream-owned files at repository root and make the update/workflow explicit and reviewable.
• Provide contributor/agent guidance and CI guardrails to safely migrate tests/scripts to reference upstream/... paths and to stage the cutover.

Description

• Add a new Phase: Upstream submodule cutover (upstream/) section to TODO.md describing repository layout cleanup, path migration, compatibility versioning, documentation updates, staged rollout steps, and exit criteria.
• Update README.md to document the upstream/ submodule model, the compatibility expectation tied to the pinned commit, and the submodule initialization command git submodule update --init --recursive.
• Add AGENTS.md at repository root with explicit policies: upstream/ is canonical for upstream sources, update workflow for bumping the submodule, and pathing expectations for tests and scripts.
• Commit the documentation and checklist changes to the current branch so the plan and contributor rules are available for follow-up PRs that will perform path rewrites and code removals.

Testing

• No automated tests were run as part of this change because the modifications are documentation-only and do not alter code or CI test configuration.

---

Codex Task