Codify the commit-message rule: why over what

The rewrite of the early history (courtesy commits, amendonitas) made
the house style explicit, but nothing in this file asked for it — the
next contributor had no rule to imitate on purpose. State it where the
other readability judgements live: body carries the bug, constraint or
rejected alternative; imperative subject; one logical change per
commit.

AGENTS.md

@@ -214,6 +214,13 @@ guidelines. Optimising for that reader is not optional polish. Concretely:
   go wrong. (The client helpers in `adapter.py` document the split locally.)
 - **Docstrings on every public method**, following PEP 257 — plus the override
   marker required by *Overriding* below.
+- **Commits explain why, not what — same rule as comments.** The diff already
+  shows what changes; the message earns its body by recording the bug that
+  motivated it, the constraint it honours, or the alternative it rejected.
+  Subject line in the imperative ("Fix auth bypass", not "Fixed" or "auth"),
+  one logical change per commit — a commit that needs "and" in its subject,
+  or a `WIP`/placeholder subject, wants to be split or finished first. The
+  history after August 2026 is the house style to imitate.
 
 ### Linting & Type Checking