fix(agents): what the review of dependency notes found

A review of the feature turned up the following, fixed here.

Writing. AGENTS.md was replaced through a temporary renamed over it,
which swaps in another file: a read-only AGENTS.md was rewritten
anyway, a hard link such as a CLAUDE.md beside it kept the old text,
ACLs and ownership were dropped, and without an fsync a power cut could
still leave it empty. The temporary was named after the PID, which
every Flatpak instance shares as PID 2. The file is now written in
place, from the first byte that differs, then truncated and synced,
under an flock on the file itself. A write that fails partway is undone
where the disk allows; with the section last, where it is appended,
only the section can be damaged. A read-only file is opened for writing
only when something would change, so it is refused then and silent
otherwise.

Reading. libc++'s filebuf reports a failed read as the end of the file,
so an I/O error came back as a short file and the section was written
over what was left. Reads go through read(2).

Code fences. ```make``` was taken for a fence, and a fence in a list
item was missed while its indented closer opened one, so markers a user
quoted in a code block could be taken for the section, or the real one
hidden and appended again. Backtick info strings, block quotes and list
items are now followed, and a block ends with its container.

Warnings with nothing to write. With no notes, nothing short of a
well-formed section is reported, so an AGENTS.md that ends in an open
code block, or a project set to None, no longer warns on every build.
An unclosed fence after a section no longer stops it being rewritten
in place.

Labels. The `from` line carried the git URL, credentials and all, or a
path relative to the consumer that changed with the machine, the cache
location and --local. It is now the repository's or the directory's
name. Notes are deduplicated by repository rather than by clone, so one
library pinned two ways is described once, as the nearer spec has it.

The walk. It no longer looks at the project's tests: a plain build
never did, and a test's dependency can point at the Configuration the
project file returned by value. It goes ring by ring over projects
rather than configurations, so what the project names itself comes
first even with the library/executable split. The project's own
AGENTS.consumer.md is excluded by path, also when a dependency's
project file sits beside the project's.

Removing a section dropped a blank line even from between two
paragraphs, joining them; only a section that ends the file takes it
now. A CRLF file gets a CRLF section.

A note was checked on its raw bytes and again, under other whitespace
rules, on the trimmed ones, so it could pass the first check and fail
the merge, which then dropped every note. It is normalised once and
checked on exactly what is merged.

`test --list` only lists, and no longer writes AGENTS.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

implementations/Crafter.Build-Clang.cpp

@@ -1701,7 +1701,7 @@ Clean (after the `clean` subcommand):
   and dependency artifact under those trees goes with it.
 
 AGENTS.md:
-  When an AGENTS.md sits beside the project file, a build and `test` keep a
+  When an AGENTS.md sits beside the project file, a build and a test run keep a
   section in it holding the AGENTS.consumer.md each dependency ships beside its
   project.cpp, and write the file only when that section changes. An AGENTS.md
   is never created. cfg.dependencyNotes picks the dependencies: Transitive (the
@@ -1877,10 +1877,11 @@ std::int32_t Crafter::Run(std::int32_t argc, char** argv) {
 
         // Builds and test runs only: lint and `format --check` promise to
         // write nothing, `format` rewrites the project's sources and nothing
-        // else, and `run` is for chores. Here, before compiling, because
-        // loading has just fetched every dependency, so the notes are
-        // current, and an agent fixing a build that fails needs them.
-        UpdateAgentsMd(config, projectFile);
+        // else, `run` is for chores and `test --list` only lists. Here,
+        // before compiling, because loading has just fetched every
+        // dependency, so the notes are current, and an agent fixing a build
+        // that fails needs them.
+        if (!testOpts.listOnly) UpdateAgentsMd(config, projectFile);
 
         if (runTests) {
             TestSummary summary = RunTests(config, testOpts, projectArgs);