self-development: add review-derived agent conventions

[kelos-bot]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

Adds four evidence-backed agent conventions to the self-development AgentConfig
(AGENTS.md/CLAUDE.md, self-development/agentconfig.yaml, and
self-development/kelos-workers.yaml), each derived from recent PR reviews.

1. Broaden the "vacuous substring assertions" rule to stream-forwarding tests

Motivated by PR #1189 (Stream agent output through kelos-capture):

• The Kelos Reviewer flagged (P3): "assertForwarded only checks substring presence; misses reordering/duplication" and recommended a byte-level comparison.
• cubic-dev-ai independently flagged the same line (P2, confidence 9): "Forwarding check too weak. Contains can miss dropped/reordered/duplicated lines. Compare normalized full output instead."
• The landed fix compares the forwarded stream byte-for-byte.

The existing convention was scoped narrowly to label: value printer/formatter
assertions; this extends it to writer/pipe forwarding tests.

2. Require author/subject filters on autonomous-run triggers

Motivated by PR #1241 (Add kanon-development TaskSpawners), whose new
event-driven triggers shipped without author scoping. The review flagged this
twice and both fixes were applied in that PR:

• P1 (confidence 9) on kanon-pr-responder.yaml: "Add an author filter to the pull_request_review trigger; without it, unapproved review comments can trigger autonomous task runs."
• P2 on kanon-reviewer.yaml: the issue_comment trigger was "not scoped to pull requests, so /kelos review on a regular issue can start the reviewer and make PR-only review commands fail."

Existing conventions only noted that issue_comment fires for both issues and
PRs; they did not state the baseline that every autonomous-run trigger must be
restricted to a trusted author allowlist and the intended subject
(commentOn: PullRequest for PR-only commands). This adds that rule so future
spawners ship the filters up front instead of being corrected in review.

3. Distinguish "not found" from "lookup failed" in request handlers

Motivated by PR #1238 (Add WebhookGateway CRD), whose request handlers
conflated API lookup errors with empty results. The review flagged this
repeatedly and the maintainer fixed every instance (see his summary on the PR):

• P1 (confidence 9): "TaskSpawner list errors are treated as an empty match set, so transient API failures can silently drop webhooks with a 200 response." Fix: "listGatewayScopedSpawners now returns the error; the handler responds 5xx so a transient API failure is retried instead of being swallowed as a 200."
• Fix: "gateway Get now returns 404 only on IsNotFound; other errors (RBAC/transient) return 500."

The existing "fail fast on invalid configuration" rule covers startup
config/secrets, not request-time API reads. This adds a distinct convention so
handlers and reconcilers propagate List/Get errors as 5xx (the sender
redelivers) instead of answering 200 with an empty result that silently
drops the event.

4. Honor reduced-motion preferences in web UI

Motivated by two recent PRs that independently added continuous running-state
animation without a reduced-motion fallback:

• PR Show Session runtime state in Session server #1481, P3 review comment: the running Session dot "pulse[s] indefinitely even when a user requests reduced motion"; the reviewer asked to gate the animation behind prefers-reduced-motion: no-preference while retaining the static color and halo.
• PR Report Session activity with conditions #1482, P2 review comment: the same pulse lacked a prefers-reduced-motion fallback, compounding the existing accessibility gap in other pulsing elements.

The shared configuration had no motion-accessibility guidance. This adds a
focused rule requiring continuous or non-essential animation to honor
prefers-reduced-motion and keep a distinguishable static state when motion
is disabled.

Files updated (the canonical agent-rule locations; CLAUDE.md is a symlink to AGENTS.md):

• AGENTS.md / CLAUDE.md
• self-development/agentconfig.yaml
• self-development/kelos-workers.yaml

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

Convention-only change; no code or runtime behavior is affected. The branch was
rebased onto current main, and make verify passes.

Does this PR introduce a user-facing change?

NONE