#8 Releases+artifacts, api JSON, agents page

Context: Releases + machine surface. Artifacts rule: no size cap — copy whole releases/out/<ver>/ if present. Tasks:

• /releases/ + detail: notes body rendered, sha shown, sha256 lines from notes; artifacts copied to dist/releases/<ver>/, linked, served with nosniff note in serve headers; absent out/ -> notes-only (normal, no warn).
• /api/issues.json|pulls.json|commits.json|releases.json|wiki.json: compact fixed-order JSON from same readers; counts match HTML.
• /agents.html + /agents.md: read paths (raw/api/tarball/bundle), submit guide (urlencoded POSTs, caps table, license quote, curl examples for issue + pr-prompt), "prompt not code" guidance. Free-text philosophy stated. Success rubric:
• Fixture release with out/ artifacts: downloads byte-identical, sha256 lines shown; release without out/: notes-only page.
• api JSON parses (jq empty), counts equal HTML list counts; agents.md curl examples actually POST successfully against test serve (loopback, temp inbox). Swarm: Owl. Branch m3/releases-api.