Promote: template convergence + CI/CD process learnings (#368)

Promotes the two commits currently ahead on `develop` to `main`.

Closes #329
Closes #339

## What's promoted
- **#367** - carry the template's "In a derived repo:" upstream-drift
reporting paragraph into `.github/copilot-instructions.md`. This was the
last substantive verbatim-carry gap from a full audit of both
convergence issues against `ptr727/ProjectTemplate`.
- **#366** - record two CI/CD process learnings in `AGENTS.md` (mirror
main-only fixes back to `develop` with a content-diff staleness check;
put `Closes #N` on the promotion PR), converged through the Copilot
review loop.

## Convergence audit (why #329 and #339 are done)
Audited every item in both issues against the current template. This
repo is intentionally NuGet-only, no codegen, no Docker, so most items
were already converged by prior work:
- **#329**: the Copilot review runbook
(`.github/copilot-instructions.md`), the AGENTS.md "PR Review Etiquette"
contract, and `.markdownlint-cli2.jsonc` (byte-identical to the
template) are all present. Only the "In a derived repo:" paragraph was
missing (#367).
- **#339**: `.editorconfig` `[*.cs]` marked .NET-only with matching
per-extension EOL rules; AGENTS.md comments house-rule, markdown
trailing-backslash, and versioning-without-"develop-ahead";
`CODESTYLE.md` (General + .NET, Python dropped); `retention-days: 1` on
the one artifact upload. Docker registry-cache guidance is N/A (no
Docker workflow).

Remaining differences are intentional, repo-accurate divergence
(NuGet-only project names, `CODESTYLE.md` build-requirements text
matching this repo's actual `Directory.Build.props`).

## Not included
Issue **#348** (branch-ruleset drift: extra `creation` rule +
`do_not_enforce_on_create`) is maintainer-gated live GitHub config and
is intentionally left for a maintainer decision (whether the extra
`creation` rule is intended). Surfaced separately, not closed here.

## Diff
`develop` is a clean superset of `main` (4 insertions across two doc
files, no deletions - no `main`-only stragglers).

Author: ptr727

.github/copilot-instructions.md

@@ -150,3 +150,5 @@ After the final push, sweep-resolve stale older threads for removed code paths.
 ## When in Doubt
 
 Read [AGENTS.md](../AGENTS.md) for this repo's conventions. For code-style rules, [`CODESTYLE.md`](../CODESTYLE.md) (its General and .NET sections) is authoritative. Don't restate any of these files' rules in commit bodies or PR descriptions - keep those focused on the change itself.
+
+**In a derived repo:** if you find a discrepancy that should be fixed in the template itself (this file or AGENTS.md is out of date, a rule is missing, something bit this repo and would bite the next), open an issue upstream in [`ptr727/ProjectTemplate`](https://github.com/ptr727/ProjectTemplate) rather than only fixing it locally - see the template's [AGENTS.md "Staying in Sync and Reporting Drift Upstream"](https://github.com/ptr727/ProjectTemplate/blob/main/AGENTS.md#staying-in-sync-and-reporting-drift-upstream).

AGENTS.md

@@ -21,6 +21,8 @@ This is the developer-facing git policy. The branch rulesets that enforce it (me
 - **`develop` is forward-only**: no `main -> develop` back-merges. Historical back-merge commits in `git log` predate this rule and must not be repeated.
 - All commits on both branches are cryptographically signed (see Git and Commit Rules). Squash and merge commits created in the GitHub UI are signed by GitHub's web-flow key.
 - **Bots target both `main` and `develop` directly.** Dependabot opens PRs against each branch independently. This is deliberate: running a bot on one branch and merging its changes across to the other causes endless conflicts as the feature -> develop -> main flow moves underneath it, whereas landing the same dependency update directly in each branch keeps bot changes conflict-free regardless of what else is in flight, and keeps the `main` package fresh without waiting on a promotion. Dependabot security PRs open against `main`. The mechanics (Dependabot's per-target-branch config) are in [`WORKFLOW.md`](./WORKFLOW.md) D8.
+- **Mirror to `develop` any change that lands on `main` outside the feature -> develop -> main flow.** "Mirror" means land the same fix directly on `develop` via a follow-up PR targeting `develop` - never a `main -> develop` back-merge, which the forward-only rule forbids. A reconciliation-branch fix made to resolve a `develop -> main` promotion conflict, or a security PR that merges only to `main`, leaves `develop` behind on that content - and forward-only `develop` never back-merges to catch up (the same parallel-target principle as the bots). Before basing new work on `develop`, or diagnosing a defect from it, compare content and not commit history: run `git diff origin/main origin/develop` and inspect its `-` lines - the `main`-side of each difference, to check for staleness. A `-`/`+` pair within one hunk is usually just `develop` modifying that code as normal unpromoted work (occasionally `develop` is reworking a `main`-side fix differently - worth a glance). The stronger staleness signal is a deletion-only hunk (`-` lines, no `+` lines): content on `main` that `develop` lacks entirely, i.e. a `main`-only fix `develop` never received, so the defect may already be fixed on `main`. Prefer this over a commit-log check like `git log origin/develop..origin/main`, which is noisy here because it also lists routine promotion merges and the `main`-direct bot commits whose content `develop` already carries via its own parallel bot PRs.
+- **Put issue-closing keywords (`Closes #N`) where they fire on merge to the default branch (`main`).** GitHub closes an issue from a *PR description* only when that PR merges to `main`, so a `Closes #N` in a PR that targets `develop` never fires - put it in the `develop -> main` promotion PR instead. A closing keyword in a *commit message* does close the issue once that commit reaches `main` via promotion, but that is fragile across squash-merges, so prefer the promotion PR's description or close the issue manually once the fix lands on `main`.
 
 ## Release Model