Bootstrap initial agents package structure

[coisa]

Related Issue

Closes #1

Motivation / Context

• Split the packaged .agents payload out into the new fast-forward/agents package as the first repository-side step for [agents] Extract packaged agents into fast-forward/agents and install via composer installer-paths dev-tools#195.
• Keep dev-tools as a global tool here for now so this package can later become a dependency of dev-tools without a local package cycle.
• Use the released fast-forward/composer-installers package instead of the generic composer/installers + extender path, so consumers receive copied payload files instead of package-root symlinks.
• Prefix packaged Fast Forward-owned agent files and skill directories with fast-forward- to reduce collisions with consumer-owned local agents and skills.

Changes

• Copies the current packaged project agents and skills into .agents/.
• Prefixes packaged agent files as .agents/agents/fast-forward-*.md.
• Prefixes packaged skill directories as .agents/skills/fast-forward-* while preserving the skill names declared inside SKILL.md.
• Adds Composer metadata for fast-forward/agents as a fast-forward-resource-bundle.
• Requires fast-forward/composer-installers:^0.1.
• Removes the previous composer/installers / oomphinc/composer-installers-extender dependency and metadata assumptions.
• Documents package-specific installer-paths rules where fast-forward/agents materializes into .agents/, while a future workflow bundle can materialize into .github/workflows/.
• Keeps the package content-only for now: removes the premature AgentBundle PHP API, Composer autoload metadata, PHPUnit dependency, phpunit.xml, and tests.
• Adds README/docs/AGENTS guidance, changelog entry, repository automation, and package payload validation in CI.
• Adds a CodeQL Actions workflow for the required Analyze (actions) status and keeps report/wiki publication deferred until dev-tools can run its bundled toolchain globally.

Verification

• composer dev-tools full standards gate: deferred until dev-tools has a standalone/global toolchain shim; the current global binary still expects local Rector/ECS/phpDocumentor/PhpMetrics binaries for that command.
• composer validate --strict locally.
• composer validate --strict inside backup/.
• Packaged payload smoke check for .agents/agents, .agents/skills, prefixed agent files, prefixed skill directories, and Composer bundle metadata.
• composer dev-tools changelog:check -- --file=CHANGELOG.md --against=origin/main
• Workflow YAML parse check with Ruby YAML.load_file.
• Local backup/ Composer smoke with symlinked path repositories for both fast-forward/agents and fast-forward/composer-installers, installing the installer as 0.1.0.
• backup/ payload smoke confirmed .agents/agents/fast-forward-issue-implementer.md and .agents/skills/fast-forward-github-pull-request are copied as regular paths, without the old unprefixed paths.
• backup/ manifest smoke confirmed vendor/fast-forward/.composer-installers/fast-forward_agents.json tracks the prefixed payload entries.

Documentation / Generated Output

• README updated
• docs/ updated
• AGENTS.md updated
• Generated or synchronized output reviewed

Changelog

• Added a notable CHANGELOG.md entry

Reviewer Notes

• fast-forward-resource-bundle is intentionally generic; the target directory is selected by package-specific installer-paths entries.
• This package intentionally exposes no runtime PHP API yet. composer.json is the bundle contract until dev-tools has a concrete integration need.
• The local backup/ smoke project is ignored by git and configured to use path repositories for pre-release testing.
• The full report/wiki workflows are present but intentionally deferred in this initial package until the dev-tools follow-up removes the local-toolchain assumption.