Add AGENTS.md with AI security-audit guidelines

[pepone]

Adds AGENTS.md, with guidelines doc for AI coding agents (Codex, Claude Code, Copilot, etc.) running security audits of this repository. It documents:

• the two-repo model (zeroc-ice/ice public, zeroc-ice/ice-audit private);
• the mandatory two-independent-pass workflow (initial report + verification) and the verdict vocabulary;
• issue routing by severity — security-sensitive Medium-and-above go private, everything else public;
• issue conventions (labels, milestone, AI-generated banner, commit-pinned citations);
• the catalogue of already-dismissed audit patterns so agents don't re-file findings closed as "Not planned".

[Copilot]

Pull request overview

Adds a new AGENTS.md document that standardizes how AI coding agents should conduct and route security audits for this repository, including a two-pass verification workflow, issue filing conventions, and a catalog of previously dismissed audit patterns to prevent duplicate/rejected findings.

Changes:

• Introduces the two-repository model (zeroc-ice/ice public vs zeroc-ice/ice-audit private) and severity-based routing rules for findings.
• Documents a mandatory two-independent-pass audit workflow with a defined verdict vocabulary and commit-pinned citation requirements.
• Defines issue-filing conventions (titles/labels/milestones/body template) and lists dismissed audit patterns with canonical references.

[bernardnormier]

Since an agent can only run such an audit when it has access to both repos (ice and ice-audit), should we put this AGENTS.md in the ice-audit repo?

[externl]

If I understand how AGENTS.md is supposed to work. See also https://agents.md

• I think this is too bloated. AGENTS.md is meant to be read by agentic agents per session. it should be relatively lean to limit token usage.
• It's not just about security audits.

We should have something more like Homebrew's:

• https://github.com/Homebrew/brew/blob/main/AGENTS.md
• https://github.com/Homebrew/homebrew-core/blob/main/AGENTS.md

if we want something an agent reads when doing audit analytics I think belongs elsewhere.

[externl]

AGENTS.md is not just about security audits. I would just go with the typical # AGENTS.md

See https://agents.md

Suggested change

	# Repository Guidelines for AI Coding Agents — Security Audits
	# AGENTS.md

[externl]

Is this necessary? Seems like wasted tokens/context.

[pepone]

I will move this to ai-audit, and keep as a security audit recipe instead of as the general agents file