chore(ai): add agent self-review and a CI check for agent-assisted PRs

Additional changes
Agents write a task plan to .scratch/<branch>/plan.md and self-review with code-review
Agents fix hard violations, report judgement calls and rerun the self-review before every push
Agents declare the review in a Self-review section of the pull request body
Add the ai-self-review workflow and scripts/check_pr_self_review.py for pull requests into main
Detect agents by Assisted-by or Anthropic Co-Authored-By trailers, body markers or the AI box
Fail only on a missing Self-review section or a missing, malformed or stale Reviewed SHA
Note an unticked AI-assisted box and malformed optional lines without failing
Comment on the pull request how to fix a failure and update that one comment on later runs
Show the same report in the job summary and accept Windows line endings in the body
Skip dependabot and release pull requests
Run on pull_request_target with the base branch's script, never pull request code
Add the pull request template: the pr skill's sections plus Checklist and Self-review
Require always valid optimization parameters in the energy-domain skill
Require datetimeutil for date and time handling in new and changed code in AGENTS.md
Require the Assisted-by trailer on agent commits in the commit-messages skill
Add tests for the check in tests/test_ai.py
Add GLOSSARY.md and the agent tracker docs in docs/agents/
Add decision record docs/adr/0001 with an ADR index in the docs toctree
Document the workflow in docs/develop/ai.md and CONTRIBUTING.md
Exclude docs/agents from Sphinx and PyMarkdown and ignore .scratch/
Document cz check instead of make gitlint for commit messages in docs/develop/ai.md

Assisted-by: Claude Code (claude-opus-5-5)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/adr/0001-self-declared-sha-bound-review-gate.md

@@ -0,0 +1,32 @@
+# CI enforces a self-declared, SHA-bound self-review for agent-assisted pull requests
+
+Pull requests that a coding agent wrote or co-wrote must carry a `## Self-review` section in the
+pull request body that names the full head commit SHA it reviewed. CI does not verify the review
+itself: the project has no AI in CI, and a signing key in the sandbox would be reachable by a misled
+agent. Instead CI detects agent assistance (an `Assisted-by:` or Anthropic `Co-Authored-By:` commit
+trailer, an `Assisted-by:` line or a known agent footer in the pull request body, or the
+"AI-assisted" box in the pull request template). It fails only when the declaration or its
+`Reviewed:` SHA is missing or malformed, or names a SHA other than the current head; everything
+else (an unticked box next to a trailer or marker, malformed optional lines) is only noted. Like a
+DCO sign-off, this makes forgetting impossible and a false claim deliberate; the author review and
+the maintainers' review remain the actual controls.
+
+## Considered Options
+
+- **AI review in CI**: rejected, the project runs no AI in CI.
+- **Signed review attestation from the sandbox**: rejected, the agent can reach the key and sign
+  anything.
+- **Honour system (template checkbox only)**: rejected, a declaration that is not bound to a commit
+  silently covers code pushed after the review.
+
+## Consequences
+
+- Every push to an agent-assisted pull request needs a fresh self-review before the push and an
+  updated pull request body right after it; rebases and squashes before merge do too.
+- Open findings do not fail the check, so agents have no incentive to hide them.
+- The check only blocks merging once maintainers make it a required status check.
+- The workflow runs on `pull_request_target` with the base branch's script and never runs pull
+  request code, so a pull request cannot weaken its own check; changes to the check take effect
+  only after they are merged.
+- The workflow needs `pull-requests: write` to comment how to fix a failing check. That is safe
+  only as long as it runs no pull request code.