agents: add bazelrc rules and clarify script execution conventions

.agents/rules/bazelrc.md

@@ -0,0 +1,18 @@
+---
+trigger: glob
+description: Bazel configuration (.bazelrc) rules and conventions
+globs: "*.bazelrc,.bazelrc"
+---
+
+# Bazelrc Rules
+
+* **Quote Values with Spaces**: Wrap flag values containing spaces in double
+  quotes (e.g., `--build_metadata="KEY=value with spaces"`). Unquoted spaces
+  cause Bazel's rc parser to treat subsequent words as build targets.
+* **Document Performance Flags**: Document performance-tuning flags (e.g.,
+  `--remote_cache_compression`, `--experimental_remote_cache_chunking`,
+  `--rewind_lost_inputs`) with inline comments explaining their concrete
+  benefit.
+* **Invocation Privacy**: Keep local invocations private. Never add
+  `--build_metadata=VISIBILITY=PUBLIC` to repository-level or user bazelrc
+  files; configure public visibility and CI metadata only in CI.

.agents/rules/python.md

@@ -20,6 +20,9 @@ globs: "*.py,*.sh"
 * Factor non-trivial scripts (such as multi-line Python or shell logic) into
   standalone files (e.g. `.py` or `.sh` files) instead of inlining them via
   heredocs (`<< 'EOF'`) or `-c` flags (`python3 -c`, `bash -c`).
+* **Directly Executable Scripts**: Scripts executed directly (outside a
+  `py_binary` rule) must have `chmod +x` (mode `100755`) and a
+  `#!/usr/bin/env python3` shebang.
 
 ## Interface & ABC Docstrings
 * In abstract base class / interface methods, always document `Args:`,

.agents/rules/shell.md

@@ -11,3 +11,5 @@ globs: "*.sh"
   with `while IFS= read -r file; do ...; done < "$manifest"`. Do not use
   unquoted command substitution (`$(cat "$manifest")`) or suppress ShellCheck
   `SC2046` assuming paths lack spaces.
+* Do not create companion `.sh` forwarders that merely pass `"$@"` to another
+  executable or script.

.agents/rules/workspace.md

@@ -11,11 +11,8 @@ basis:
 * Fetch `upstream/main` (`git fetch upstream main`).
 * Base any new branch or worktree upon `upstream/main` (e.g.,
   `git checkout -b <branch> upstream/main`).
-* Run the workspace helper script to configure upstream tracking and safe
-  pushing:
-  ```bash
-  .agents/scripts/setup_client.py <branch>
-  ```
+* Run `.agents/scripts/setup_client.py <branch>` to configure upstream tracking,
+  safe pushing, and client `user.bazelrc`.
 * Never use `git push -u` or `--set-upstream` (it breaks upstream tracking).
 * When pushing to a checked-out PR branch from an external fork, push
   explicitly to that remote (`git push <remote> HEAD:<branch>`). Do not rely on