tooling: adopt procoder governance (commit gate, skill integration, context) + remove committed AGENT_API_KEY from docs

web/docs/agent-publish-api.md

@@ -24,7 +24,7 @@ Publish and manage blog posts programmatically. Auth: send the agent key in the
 ## Create + publish a post with an image
 
 ```bash
-KEY=033d1eed44ca6abf483de10735c47155d38f7b5bc9d46449
+KEY="$AGENT_API_KEY"   # never hardcode — export AGENT_API_KEY in your shell; it lives in the server's .env.production
 
 # Inline base64 image (jpeg/png/webp, ≤5MB)
 python3 - <<'EOF' > /tmp/post.json
@@ -54,11 +54,20 @@ Response `201`:
 
 ```json
 {
-  "id": 113, "title": "دليلي الجديد", "slug": "my-new-guide",
-  "status": "published", "access": "vip", "category": "agents",
+  "id": 113,
+  "title": "دليلي الجديد",
+  "slug": "my-new-guide",
+  "status": "published",
+  "access": "vip",
+  "category": "agents",
   "cover": { "id": 113, "url": "/api/media/file/my-cover.jpg" },
   "attachments": [
-    { "id": 42, "filename": "agent-state.md", "access": "vip", "url": "/api/files/42" }
+    {
+      "id": 42,
+      "filename": "agent-state.md",
+      "access": "vip",
+      "url": "/api/files/42"
+    }
   ]
 }
 ```