docs: add AGENTS.md guidance for message and approval API patterns

[awlevin]

Summary

• Add HTTP API Patterns section to AGENTS.md documenting the new message and approval architecture
• Documents POST /v1/messages as the single send endpoint (queue-if-busy, fire-and-forget, hub publishing)
• Documents standalone approval endpoints (/v1/confirm, /v1/secret, /v1/trust-rules) keyed by requestId
• Documents channel approval patterns (Telegram callback data, guardian records)
• Explicitly lists what NOT to do: no RunOrchestrator, no /v1/runs, no runId, no run status tracking

Final PR in the remove-runs plan (PRs #8400, #8407, #8428, #8410, #9166).

Test plan

• Review guidance for accuracy against implemented code
• Verify no stale references to removed infrastructure

🤖 Generated with Claude Code

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e216824ab2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Include decision in /v1/trust-rules payload docs

The documented request shape for POST /v1/trust-rules omits decision, but the runtime handler requires decision: "allow" | "deny" and returns 400 when it is missing (assistant/src/runtime/routes/approval-routes.ts). This mismatch will cause clients/agents that follow AGENTS.md to send invalid requests and fail to create trust rules.

Useful? React with 👍 / 👎.