refactor: relocate agent-system/ to .agents/ with 7-role workflow restructure

Moves the agent workflow system from agent-system/ to .agents/ (dotfile convention).
Restructured from 5-role to 7-role pipeline: adds Analyst and splits Reviewer into
Code Reviewer + Security Reviewer. Removes all old workflow run artifacts.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.agents/skills/core-guardrails/references/quality-gates.md

@@ -0,0 +1,40 @@
+# Quality Gates
+
+## Pflicht-Gates
+
+1. `docker compose exec php vendor/bin/phpunit`
+2. `docker compose exec php vendor/bin/phpstan analyse -c phpstan.neon --no-progress`
+3. `docker compose exec php vendor/bin/phpunit tests/Architecture/CoreStarterkitContractTest.php`
+
+## Struktur-Gates (schnell)
+
+```bash
+(rg 'new\s+[^\s(]+Factory\(' lib/Service || true) | wc -l
+(rg --glob '!**/*Factory.php' 'new\s+[^\s(]+(Service|Gateway|Repository)\(' lib/Service || true) | wc -l
+(rg "\b(accessServicesFactory|directoryServicesFactory|userServicesFactory|authServicesFactory|tenantServicesFactory|settingServicesFactory|userRepositoryFactory|authRepositoryFactory|authGatewayFactory)\(" pages lib templates web || true) | wc -l
+(rg -n 'new\s+[^\s(]+(Service|Gateway|Repository)\(' pages -g '*.php' || true) | wc -l
+(rg -n '\bDB::' pages -g '*.php' || true) | wc -l
+(rg -n 'app\([^\n]*Factory::class\)->create' pages/admin -g '*.php' || true) | wc -l
+(rg -n 'Factory::class' pages/admin -g '*.php' || true) | wc -l
+(rg -n 'ApiResponse::readJsonBody\(' pages/api/v1 -g '*.php' || true) | wc -l
+```
+
+Erwartung: jeweils `0`.
+
+## JS-Scope
+
+- Bei JS-Aenderungen Browser-Smoke mit DevTools-Console durchfuehren.
+- Erwartung: keine neuen JS-Errors.
+
+## Docs-/Skills-Gates (schnell)
+
+1. `bin/docs-link-check.sh`
+   - prueft Doku-Links in `README.md`, `docs/**`, `.agents/skills/**` und `.agents/**`
+   - `.agents/runs/**` ist standardmaessig ausgeschlossen (historische Artefakte)
+2. `bin/codex-skills-sync.sh --check`
+   - prueft Drift zwischen Repo-Skills und `~/.codex/skills`
+
+## Berichtspflicht
+
+- Bei jedem Gate klar angeben: `passed` / `failed` / `not run`.
+- Bei `failed` den blocker explizit benennen.