[justaugustus]

What kind of change does this PR introduce?

Agent guidance for simplifying code, plus one simplification that follows it (infra/tests/other). No change to
scores, findings, or output.

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Scorecard has no agent guidance; .gitignore excludes AGENTS.md. An agent asked to simplify code here falls back on
generic refactoring advice, which allows deleting "unused" exported functions and editing tests until they pass.

In pinning detection, collectUnpinnedPackageManagerDownload builds the same dependency five times, once per package
manager, so adding one means copying a 20-line branch. Its tests never check the dependency type for Go or npm
commands, or the remediation text on unpinned NuGet commands.

What is the new behavior (if this is a feature change)?

Behavior is unchanged. This PR has three commits:

1. AGENTS.md with a simplification section: scope to one target, add characterization tests first where
   coverage is thin, never change tests in the simplification itself, and a list of what a simplification must not
   touch (output, scores, flags, exported API, error and token handling). It points to CONTRIBUTING.md for the
   contribution process rather than repeating it. .gitignore now tracks the root AGENTS.md and still ignores
   nested ones. CODEOWNERS sends it to @ossf/scorecard-maintainers, since *.md would otherwise route code rules
   to doc review.
2. Characterization test TestCollectUnpinnedPackageManagerDownload: the full dependency for a pinned and an
   unpinned command per package manager, plus a command that isn't one.
3. A table of detector, pinned test, dependency type, and remediation text replaces the five branches. Order is
   kept, and the first match still wins. The function goes from 125 lines to 47, and the file's duplicated block is
   gone.

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

NONE

Special notes for your reviewer

Main question: are these the rules you want agents to follow? The AGENTS.md list is the part that outlives this
PR. Two rules are stricter than common refactoring advice: exported API is never removed, renamed, or deprecated as
part of a simplification, even with no callers found, and existing tests never change in the same commit.

In the refactor, each unpinned NuGet dependency still gets its own finding.Remediation. Sharing one pointer from the
table would be shorter, but collectPostProcessNugetCPMDependencies appends to Remediation.Text in place, so the
suffix would leak across dependencies. The tests don't cover that path; a comment marks it.

Out of scope: the is*Download and is*Unpinned detectors, which carry most of this file's bug-fix history. The
contribution and review sections of AGENTS.md, and CODEOWNERS for other agent config files, are separate work.

Verification beyond CI: with the new test in place, I changed the npm dependency type and one word of the NuGet text,
and 3 cases failed.

Rollback: each commit reverts on its own; please rebase-merge.

Does this PR introduce a user-facing change?

NONE

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.59%. Comparing base (353ed60) to head (3ad228a).
⚠️ Report is 470 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #5428       +/-   ##
===========================================
+ Coverage   66.80%   79.59%   +12.79%     
===========================================
  Files         230      264       +34     
  Lines       16602    14838     -1764     
===========================================
+ Hits        11091    11811      +720     
+ Misses       4808     3026     -1782     
+ Partials      703        1      -702     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.