[no-ci] Support organization-owned forks in AGENTS.md

[rwgk]

Description

This updates the repository-wide agent guidance to support approved forks owned by either personal accounts or organizations.

The existing guidance assumes that every contributor uses a personal fork and can always open a pull request with gh pr create. That command currently cannot identify some renamed organization-owned forks (cli/cli#10093), even though GitHub's GraphQL API supports selecting the head repository explicitly through headRepositoryId.

The update:

• requires agents to distinguish the canonical repository and fork by complete OWNER/REPOSITORY names;
• keeps the canonical repository read-only by default, with a narrowly scoped exception when the user explicitly requests a specific upstream test branch;
• uses gh pr create when it can identify the fork unambiguously;
• documents the GraphQL headRepositoryId fallback for organization-owned forks; and
• preserves pull-request template, assignee, label, and milestone requirements regardless of how a pull request is created.

The wording is intentionally repository-neutral so the guidance remains applicable across supported development setups.

Review focus:

• Is the upstream-push exception narrow enough while still supporting workflow testing?
• Is the API fallback clear enough for agents to use reliably?
• Are the fork and repository identity checks sufficiently explicit?

This PR does not have an associated GitHub issue.

Validation:

• pre-commit run --files AGENTS.md
• git diff --check

Checklist

• New or existing tests cover these changes. (Not applicable: this is an agent-guidance-only change.)
• The documentation is up to date with these changes.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.