Add AGENTS.md guidance for AI coding agents - #13980

AGENTS.md:22

• -race is not enabled by default here: TESTFLAGS_RACE is empty in the Makefile unless the caller sets it. As written, this will send readers looking for a non-existent default behavior.

Run `make clean-test` only on a dedicated test host: it sends SIGKILL to every `containerd` and `runc` process, unmounts matching debris, and removes runtime state. `-race` is on by default for amd64 (`TESTFLAGS_RACE`).

AGENTS.md:63

• This sentence says all new files need the Apache license header, but existing Markdown docs in this repo (e.g., BUILDING.md, README.md) do not have that header. To avoid misleading guidance, please narrow this to "new source files" (or otherwise scope it) rather than implying it applies to documentation files too.

- The org-wide [containerd/project CONTRIBUTING.md](https://github.com/containerd/project/blob/main/CONTRIBUTING.md) applies to all containerd repos: coordinate with maintainers before large or high-impact PRs, commit messages tell the story of the change, and a squashed series gets its message rewritten as one change. New files need the "Copyright The containerd Authors" Apache license header; CI validates it (`containerd/project-checks` in ci.yml).

AGENTS.md:64

• This bullet attributes trailer guidance ("AI tools never appear in Signed-off-by/Co-authored-by" and "Assisted-by is encouraged") to CONTRIBUTING.md, but CONTRIBUTING.md's "Automated and AI-generated contributions" section does not mention trailers. Consider removing the trailer guidance here or citing the document that actually defines that policy.

- CONTRIBUTING.md AI policy: PRs must be opened by a human (automated PR creation requires prior maintainer approval), and all AI-generated or AI-assisted content must be reviewed by its human author, who is responsible for its correctness. AI tools never appear in `Signed-off-by:` or `Co-authored-by:` trailers; an `Assisted-by:` trailer naming the tool is encouraged.

CONTRIBUTING.md:75

• The wording here diverges from the repo’s established description of ctr. SCOPE.md describes ctr as a barebones CLI intended for development/debugging with no stability guarantees, but not as “unsupported”, and it doesn’t state that “new features target the Go client API”. Consider aligning this bullet with the existing wording to avoid overclaiming support policy.

- `cmd` - All Go main packages and the packages used only for that main package; `ctr` is an unsupported debug CLI, and new features target the Go client API

Suppressed comments (2)

BUILDING.md:267

• This is broader than the repository's actual convention: several root-dependent tests use direct UID checks instead of testutil.RequiresRoot (for example plugins/content/local/store_test.go:119 and internal/cri/server/podsandbox/helpers_linux_test.go:70). Those packages are not selected by make root-test, so an agent following this wording could believe the root suite covered tests that still remain skipped. Limit the statement to tests using the helper and call out the direct-check exceptions.

A test that needs `root` calls `testutil.RequiresRoot`, which skips it unless
`-test.root` is passed. `make test` skips those tests and still succeeds, so check
whether the tests covering your change are among them. `make root-test` selects
the packages that call the helper and runs them with `-test.root`.

BUILDING.md:264

• This description omits the companion testutil.RequiresRootM helper, which is used by integration/client/TestMain to gate an entire package on root. Please mention both helpers so agents do not assume every root-gated test calls RequiresRoot directly.

A test that needs `root` calls `testutil.RequiresRoot`, which skips it unless

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite