feat: add output locations hard rule

[alanxy3000]

The reports sometimes will be generated in the cases directory, which is not expected. I added a hard rule in AGENTS.md to prevent this.

Output Locations (hard rule)

Write user-commissioned research packages ONLY under gitignored
private/research/<OBJECT>-<YYYY-MM>/ (e.g. private/research/crdo-2026-08/).
cases/ is reserved for tracked golden examples / product-state demonstrations;
never write a user research package there unless the user explicitly says it is
a de-identified example to contribute. local/ is for local data, downloads
and cache only, never research results. Before writing a package, verify the
target with git check-ignore private/research/; if it is not ignored or the
chosen path is cases/, stop and fix the location before creating files. When
creating the package, set private_state_action to create (not waive) in
routing.json.

• Downgrade conclusions when source quality, freshness, or calculation support
  is weak.
• Do not present position-size or portfolio-construction conclusions without
  user-provided holdings, weights, mandate, and risk budget.
• Use research actions only; never present autonomous trade execution.