docs: 明确分支与 PR 纪律，禁止直接 push main

[frankiehot-tech]

背景

上一次改动（51d88f7a 污染清理 + a29842ae Vortex369 TLA+）直接 push 到 main，触发远端 Bypassed rule violations: Changes must be made through a pull request。本 PR 把 PR 流程写成成文约定，避免复发。

改动

• AGENTS.md · Boundaries：新增禁止项「直接 push 到 main（含 bypass 分支保护）」
• AGENTS.md · Handoff Discipline：新增「分支与 PR 纪律」小节 — 分支命名 <type>/<slug>、gh pr create --fill、等 CI + 治理门禁（G1-G4 + oss-check）全绿再合并、优先 squash、禁止混入无关工作区改动
• CONTRIBUTING.md：分支命名由过时的 feature/ 统一为仓库实际惯例 <type>/<slug>（实际分支均为 feat/ fix/ chore/ docs/）

依据

1. CONTRIBUTING.md:3-4 — MAREF 采用 Pull Request 模式
2. 远端分支保护规则 — Changes must be made through a pull request
3. docs/oss-execution-norm-v1.0.md:44 — Feature Development 出口条件为 Code Review 通过 + 门禁

验证

• 纯文档改动，无代码影响
• push 前置门禁 G1-G4 + oss-check 全部通过
• 本 PR 自身即走 feature 分支 + PR 流程（自我遵循）

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Athena seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Athena seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}