Put a tiny deny-list in every agent config before the wish-list

Most starter AGENTS.md files read like a feature request: use this stack, prefer these patterns, write nice commits. Useful. Incomplete. Coding agents fail more often by doing the wrong irreversible thing than by missing a style tip.