docs: enforce strict engineering policy [skip ci]

AGENTS.md

@@ -81,3 +81,11 @@ python worker.py --worker  # start RQ worker listening on geocrop_tasks queue
 - **Secrets**: Managed via Kubernetes Secrets (e.g., `geocrop-secrets`, `geocrop-db-secret`).
 
 
+
+### 🛑 STRICT ENGINEERING POLICY
+* All approved changes MUST be committed and pushed to Gitea.
+* All deployments MUST occur ONLY through the CI/CD pipeline via ArgoCD.
+* Direct manual server modifications are forbidden.
+* No bypassing ArgoCD.
+* No hotfixes directly on running containers.
+* Infrastructure state must remain GitOps-managed.

CLAUDE.md

@@ -68,3 +68,11 @@ cd apps/worker && python worker.py --worker
 - `training/`: Model training scripts and research.
 - `plan/`: Architectural blueprints and restructuring reports.
 - `ops/`: Infrastructure scripts and data migration tools.
+
+### 🛑 STRICT ENGINEERING POLICY
+* All approved changes MUST be committed and pushed to Gitea.
+* All deployments MUST occur ONLY through the CI/CD pipeline via ArgoCD.
+* Direct manual server modifications are forbidden.
+* No bypassing ArgoCD.
+* No hotfixes directly on running containers.
+* Infrastructure state must remain GitOps-managed.

GEMINI.md

@@ -80,3 +80,11 @@ kubectl apply -k k8s/base/
 - **Jupyter**: `lab.techarvest.co.zw`
 - **Tiler**: `tiles.portfolio.techarvest.co.zw`
 - **MinIO**: `minio.portfolio.techarvest.co.zw`
+
+### 🛑 STRICT ENGINEERING POLICY
+* All approved changes MUST be committed and pushed to Gitea.
+* All deployments MUST occur ONLY through the CI/CD pipeline via ArgoCD.
+* Direct manual server modifications are forbidden.
+* No bypassing ArgoCD.
+* No hotfixes directly on running containers.
+* Infrastructure state must remain GitOps-managed.