docs: add scoped PTP timing and failure-handling contract

[masarray]

Summary

Adds src/AGENTS.md as a scoped source addendum while preserving the existing PTP Lab Clock root direction and roadmap, and hardens dependency security validation when GitHub Dependency Graph is unavailable.

Added source protections

• root-cause workflow with three-patch circuit breaker
• explicit Try/typed Result/status handling for expected packet/timing failures
• no exception unwinding through high-frequency protocol/scheduler paths
• defensive Ethernet/PTP/VLAN/message bounds validation
• bounded non-blocking async diagnostics with error-storm aggregation
• explicit separation of protocol time, software arrival time and presentation time
• transactional configuration/session state promotion
• monitor/UI backpressure and bounded evidence retention
• measured jitter/latency/queue/allocation/CPU/memory requirements

CI hardening

• keeps GitHub Dependency Review as the preferred dependency-change gate
• when the repository Dependency Graph is unavailable, falls back to .NET 8 NuGet Audit rather than disabling the security check
• Windows-targeted projects are restored on the Linux fallback runner with EnableWindowsTargeting=true
• NU1901-NU1904 vulnerability warnings fail the fallback gate

The root AGENTS.md remains authoritative for product identity, clean-room policy, claims, roadmap and UI direction.