docs: artifact-location rule + CONTRIBUTING for community growth

The whole point of this project is that the agent's growth is shareable.
If skills and extensions silently land in ~/.pi/ on the maintainer's
laptop, every clone starts from zero and the repo becomes a fancy
README. Fix that with an explicit hard rule and a contributor guide.

- AGENTS.md: new "Artifact location — hard rule" subsection spelling out
  that skills/extensions/prompts/state/.pi-settings ALL live in this repo,
  never in ~/.pi/. Pi's own built-in skills (skill-creator, etc.) stay
  user-global; the agent may use them, but their *output* must land here.
- README: new "Everything in the repo" subsection covering the same rule
  in user-facing language, plus a pointer to CONTRIBUTING.md.
- CONTRIBUTING.md (new): skill/extension formats, server-agnostic and
  no-secrets requirements, smoke-test recipe, PR checklist.
- .gitignore: switch from blanket `.pi/` ignore to `.pi/*` + explicit
  un-ignore of `.pi/settings.json`, so project Pi config is reproducible.
- "Don't push without operator confirmation" → "without human
  confirmation via the repo" — consistent with the new control model.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -10,8 +10,11 @@ yarn-debug.log*
 yarn-error.log*
 pnpm-debug.log*
 
-# Pi runtime state — sessions, caches, locally-installed extensions
-.pi/
+# Pi runtime state — sessions and cache are local-only.
+.pi/*
+# …but commit .pi/settings.json — it's the project's Pi config (installed
+# extensions, model defaults, etc.) and must be reproducible across clones.
+!.pi/settings.json
 sessions/
 *.session.json