chore(agents): add Rust code quality rules and skill (#3144)

* docs: update security advisory lessons

* chore(agents): add Rust code quality rules and skill

Add rules derived from full-project code review (48 findings across
7 dimensions) to prevent recurring issues in agent-generated code.

AGENTS.md changes:
- crates/AGENTS.md: error type design, concurrency, recursion safety,
  type casting, test quality rules
- root AGENTS.md: serde safety, naming conventions
- crates/ecstore/AGENTS.md: allocation discipline, lock ordering,
  recursion safety, dead code policy
- crates/notify/AGENTS.md: lock ordering for runtime_view/facade

Skill changes:
- code-change-verification: add Rust-specific checks (unwrap, as cast,
  clone, lock order, recursion, error types, test assertions)
- security-advisory-lessons: add serde deserialization safety pattern
- NEW rust-code-quality: automated scan + manual review checklist

crates/notify/AGENTS.md

@@ -28,6 +28,13 @@ shared plugin/runtime primitives from `rustfs-targets`.
 - `stream.rs` is a compatibility shim; new replay/runtime work should prefer
   shared helpers in `rustfs-targets::runtime`.
 
+## Concurrency
+
+- `runtime_view.rs` acquires locks in order: `stream_cancellers` → `target_list`.
+- `runtime_facade.rs` acquires locks in order: `target_list` → `replay_workers`.
+- These orders must not be reversed in new code. When adding a function that needs both `target_list` and `stream_cancellers`, acquire `stream_cancellers` first (matching `runtime_view.rs` order).
+- Do not hold write guards across `.await` points unless the hold time is bounded and the operation is unavoidably async.
+
 ## Change Style
 
 - Preserve best-effort dispatch semantics and observability signals unless the