The repo now carries more than one site: main holds www.archline.hu and
site/archlinexp.eu holds the eu site, both driven by the same
site-agnostic generator. README.md still described a single-site repo.
Rewrite README.md around the actual model: one branch per site, the
baseline's dual role (known-good reference for the HIDS diff AND the
deployment source of truth), the verify-before-you-trust rule, and why a
customized core file must never be taken from live (the updater skips
customized files, so live silently keeps a stale base -- the eu site ran
a 3.9.2 version string over pre-3.8.13 com_users code).
Add AGENTS.md for automated agents: the cardinal never-build-from-an-
infected-tree rule, the mandatory post-build checklist (YARA, IOC paths,
disguise sweep, the structural core-namespace rule that caught what YARA
missed, core version assertion), the repository boundary, commit rules
and layer semantics.
Assisted-by: claude-code@claude-opus-4-8
