docs: add managed runner GitHub preflight

[davekilleen]

What this changes

Adds contributor guidance for:

• plain-language, ADHD-friendly founder handoffs
• managed Codex runner GitHub preflight checks
• precise DNS, HTTPS-auth, and SSH failure classification
• safe handling of runner configuration and credentials

Verification

• git diff --check origin/main...HEAD
• final diff contains only AGENTS.md
• current managed runner passes DNS and GitHub API authentication checks

This PR does not change product code, credentials, production, or deployment.

[github-actions]

What this pull request touches

• other parts of Dex — No mapped product journey was detected for these paths.

Gates that will judge this change

• Personal-data gate: added lines must not expose real identities or personal vault content.
• Change-aware gates: source changes are checked for tests, path-contract use, documentation drift, and touched-file coverage.
• Tests and coverage: the Python, MCP, migration, hook, and script suites must remain healthy.
• Safety and quality: security, lint, distribution, path consistency, and large-vault checks still apply.

Based on 1 changed file.