Add AGENTS.md, CLAUDE.md symlink, and ROADMAP.md

Agent-onboarding doc for the workspace: stack, build/test/run commands,
directory layout, conventions, and always/never gotchas, plus a Current
state section. CLAUDE.md symlinks to AGENTS.md so Claude Code auto-loads
it. Longer-term backlog lives in ROADMAP.md.

ROADMAP.md

@@ -0,0 +1,26 @@
+# ROADMAP — Keysat
+
+Longer-term backlog. Near-term state lives in `AGENTS.md` → Current state.
+
+## Payments & subscriptions
+
+- Per-profile SMTP override (schema fields exist from the keysat-smtp-emails plan; needs the form + send path).
+- Rail-preference editing UI — only matters when two providers on one profile both serve the same rail; settable today via `PUT /v1/admin/merchant-profiles/:id/rail-preferences/:rail`.
+- Keysat-side dedup cache for Zaprite contacts (same buyer purchasing recurring twice can create duplicate Zaprite contacts).
+- Zaprite declined-card / expired-profile failure-body shapes are undocumented — harden `try_auto_charge_zaprite` once observed in production.
+
+## Packaging & distribution
+
+- Multi-arch publish: `Makefile` builds `arm` + `riscv`, but `publish.sh` only ships x86_64. Either build + upload all declared arches or narrow the manifest `arch` claim.
+- Align manifest `license: 'LicenseRef-Proprietary'` with the LICENSE file's `LicenseRef-Keysat-1.0`.
+- Start9 Community Registry submission — criteria are unpublished; contact Start9 directly when ready.
+- `registry-landing` repurpose — currently a stub; decide whether it becomes a real public page.
+
+## Licensing model
+
+- Evaluate Elastic License v2 vs the current custom `LicenseRef-Keysat-1.0` (parked decision).
+
+## Validation
+
+- Re-test `KEYSAT_INTEGRATION.md` against a fresh downstream app to confirm a clean one-shot SDK integration.
+- End-to-end Zaprite sandbox pass on the multi-merchant-profile webhook routing before relying on it in production.