Unify agent config via lnai and auto-generate on setup

[spawnia]

Summary

• migrate canonical agent instructions to .ai/AGENTS.md and manage Claude/Codex via lnai
• add .ai/config.json and .ai/settings.json for shared tool configuration and permissions
• run lnai sync from make setup via new ai-sync target
• split Node services into node-docs (docs workspace) and node-tools (repo-root tools)
• keep generated outputs out of VCS and ignore lnai manifest churn

Details

• rename tracked .claude/CLAUDE.md into .ai/AGENTS.md
• add explicit allow/deny command permissions in .ai/settings.json
• update Makefile commands to inline docker compose exec ... usage and use node-tools for lnai sync
• keep docs tasks on node-docs with existing port mapping

Verification

• make ai-sync completes successfully with Docker running and generates/updates .claude/settings.json and AGENTS.md symlinks

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1dea0dbb33

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Add SELinux label disable for node-tools mount

On SELinux-enforcing hosts, bind-mounted project directories are not writable/readable from containers unless they are relabeled or the container runs with label:disable. This file already applies security_opt: [label:disable] to other bind-mounted services (php, node-docs), but node-tools omits it, so make setup/make ai-sync can fail with permission errors when lnai reads or writes files under /workdir.

Useful? React with 👍 / 👎.