chore(golden-path): compliance artifacts + AGENTS.md + CI augmentation

[hiagolcm]

Summary

Bring vtex.search up to the VTEX Engineering Golden Path compliance and register it as the seventh repo in the Intelligent Search IO multi-repo workspace at vtex-apps/is-io-specs.

This is a scaffolding-only PR: it adds project-level metadata (Makefile, AGENTS.md, README at root, SECURITY.md, dependabot, MCP config, glossary/data-model docs) and augments CI with the standard danger-ci + io-app-test + lint jobs. No application code is touched and CHANGELOG.md is not modified.

What's added

File	Purpose
Makefile	vtex-io template. lint calls npx eslint directly (no --fix, per Golden Path); test/coverage print "no runner configured" since this repo has no Jest/Mocha setup today.
AGENTS.md	Canonical agent guidance: repo purpose, sources of truth, architecture, autonomy limits. Documents the legacy node/ folder.
CLAUDE.md	Symlink to AGENTS.md (so Claude Code, Cursor, etc. see the same guidance without duplication).
README.md (root)	Five Golden Path H2 sections (Prerequisites, How to run, How to test, How to publish, Documentation). The deep block reference stays at docs/README.md.
docs/glossary.md, docs/data-model.md	Repo-local terminology and contract notes. Cross-repo glossary/architecture live at the parent.
SECURITY.md	Standard security@vtex.com policy.
.mcp.json	GitHub MCP entry, matching sibling repos.
.nvmrc	12 — matches vtex.search-result and the existing dependency tree (TypeScript 3.9.7, eslint 6/7).
.github/dependabot.yml	Weekly updates for npm root, npm /react, and github-actions.

What's changed

• .editorconfig — add [Makefile] indent_style = tab.
• .github/CODEOWNERS — add global owner @vtex-apps/intelligent-search-apps; preserve messages/ @vtex-apps/localization; add docs/ @vtex-apps/technical-writers.
• .gitignore — add a spec-kit ignore block. Because this repo is public, it does NOT carry a local .specify/ — cross-repo specs live at vtex-apps/is-io-specs (see Multi-repo spec-kit extension).
• .github/workflows/pull-request.yml — add danger-ci, io-app-test, and lint jobs alongside the existing Cypress E2E job. The danger-ci job is configured with REQUIRE_CHANGELOG_VERSION: false, so this PR does not need a CHANGELOG entry of its own.
• package.json + yarn.lock — bump eslint (^7.12.1 → ^7.14.0), eslint-config-vtex (^12.3.2 → ^12.8.10), and eslint-config-vtex-react (^6.3.2 → ^6.8.2) to match the working sibling vtex.search-result. Without this bump, yarn lint crashes with Configuration for rule "@typescript-eslint/ban-ts-comment" is invalid because the older lockfile resolves @typescript-eslint/eslint-plugin@4.8.2, whose rule schema does not match what eslint-config-vtex@12.8.x writes. The refreshed lockfile resolves @typescript-eslint/eslint-plugin@4.33.0 and eslint@7.32.0, same as the sibling repo.

Lint job — continue-on-error: true

The lint job is configured with continue-on-error: true because vtex.search carries pre-existing lint debt (~9 errors + ~54 warnings under react/components/, react/utils/, react/typings/) that this PR explicitly does not fix. The job runs on every PR and surfaces the findings, but does not block merges until a dedicated cleanup PR addresses the debt.

Notes

• Legacy node/ folder. node/package.json and node/yarn.lock exist but manifest.json declares no node builder, so Toolbelt does not package this folder. AGENTS.md documents it as dead. Removing it should be a deliberate follow-up PR.
• No test runner today. make test prints a notice rather than failing. Adding a Jest setup is a deliberate engineering decision the team should make explicitly (it would also unlock a coverage threshold matching siblings).
• Cypress E2E continues to run against the biggy account via vtex/search-tests.
• No CHANGELOG.md entry. Per request, this scaffolding PR does not touch CHANGELOG.md; release-worthy changes will be logged at release time.

Companion PR

• vtex-apps/is-io-specs#5 — adds vtex.search to the multi-repo workspace plumbing (repos.yml, .code-workspace, Makefile, AGENTS.md/README/architecture).

Test plan

• make help lists the targets
• yarn install && yarn lint runs without crashing (will report pre-existing findings; that's expected)
• CI: danger-ci passes (no CHANGELOG version requirement)
• CI: lint job runs and reports findings but does not block merge (continue-on-error: true)
• CI: io-app-test action runs (no Jest config, so it's expected to be a no-op)
• CI: Cypress continues to run as before
• cat CLAUDE.md resolves through the symlink to AGENTS.md

[vtex-io-ci-cd]

Hi! I'm VTEX IO CI/CD Bot and I'll be helping you to publish your app! 🤖

Please select which version do you want to release:

• Patch (backwards-compatible bug fixes)

• Minor (backwards-compatible functionality)

• Major (incompatible API changes)

And then you just need to merge your PR when you are ready! There is no need to create a release commit/tag.

• No thanks, I would rather do it manually 😞

[vtex-io-docs-bot]

Beep boop 🤖

Thank you so much for keeping our documentation up-to-date ❤️

[github-actions]

Fails

🚫

We follow keepachangelog standards. Please, change the file CHANGELOG.md adding a small summary of your changes under the [Unreleased] section. Example: ## [Unreleased] + ### Fixed + - Issue with image sizing in the SKU Selector. Possible types of changes: Added for new features. Changed for changes in existing functionality. Deprecated for soon-to-be removed features. Removed for now removed features. Fixed for any bug fixes. Security in case of vulnerabilities.

	Warnings
⚠️	👀 The size of this pull request seems relatively large (>420 modifications). Consider splitting it into smaller pull requests to help make reviews easier and faster.

Generated by 🚫 dangerJS against a24c201