AGENTS.md: codify rule never edit vendored files

AGENTS.md

@@ -32,6 +32,12 @@ protocol v2); the matching server floor is Chatto v0.5.0-alpha.4. Refreshing `ve
 via `vendor_chattolib.sh` can move that floor (see VENDORING.md) — after each
 refresh, restate the new version here and in README.md.
 
+**Never edit vendored files.** All changes to `vendor/` must come through
+`vendor_chattolib.sh` (a full refresh). If a vendored file needs a fix,
+either update the upstream library and re-run the refresh, or apply the
+fix in the adapter code (not in `vendor/`). The dead-field sweep command
+excludes `vendor/` for this reason.
+
 ## README.md is the human README
 
 **Two audiences: AGENTS.md is read by agents with this source tree open;