docs: extract subsystem guides; keep AGENTS.md to whole-repo facts

Move subsystem mechanics (migrations, thesis gate, redaction, ingest,
email, packaging) out of AGENTS.md into docs/guides/<topic>.md, each
scoped by paths: frontmatter and symlinked from .claude/rules/ so Claude
Code lazy-loads them. AGENTS.md keeps whole-repo facts and universal
guardrails plus a one-line index per guide. Fix the inaccurate
".claude/ is gitignored" note — it is tracked.

docs/guides/packaging.md

@@ -0,0 +1,31 @@
+---
+paths:
+  - start9/**
+---
+
+# StartOS packaging & deploy
+
+Read this before building or installing the s9pk. Live target is `start9/0.4/`.
+
+## Bump the version FIRST — every build
+
+Start9 0.4.x ignores a same-version rebuild (the install silently does nothing). Before `make`:
+
+1. Edit `PACKAGE_VERSION` in `start9/0.4/startos/utils.ts`.
+2. Add `start9/0.4/startos/versions/v0.1.0.NN.ts`.
+3. Register it in `start9/0.4/startos/versions/index.ts`: import it, set it as `current`, and move the prior `current` into `other[]`.
+
+## Build (x86_64 only)
+
+```bash
+cd start9/0.4 && make        # -> ten-database_x86_64.s9pk
+```
+
+## Install — PRODUCTION
+
+```bash
+start-cli package install -s ten-database_x86_64.s9pk   # target host = $START9_BOX_HOST
+```
+
+- `$START9_BOX_HOST` resolves from your local `start-cli` context config — the real hostname is **not** in this repo.
+- **Get explicit user authorization before any production deploy/install.** Verify a new migration against a **copy** of `data/crm.db` first, never the box's DB.