refine agents and readme

AGENTS.md

@@ -0,0 +1,48 @@
+# Beacon CM4 — Quick Reference
+
+> Full docs: `beacon-buildroot/README.md`
+
+## Build
+```bash
+cd ~/repos/buildroot-beacon
+make -C rpi-buildroot-fork O=$(pwd)/output BR2_EXTERNAL=$(pwd)/beacon-buildroot -j$(nproc)
+# outputs: output/images/rootfs.raucb  update.raucb  sdcard.img.xz
+```
+
+## Flash (initial, EMMC_DISABLE jumper bridged)
+```bash
+./beacon-buildroot/scripts/flash-cm4.sh          # auto-detect
+./beacon-buildroot/scripts/flash-cm4.sh /dev/sda  # explicit device
+```
+
+## SSH / find IP
+```bash
+CM4=$(ip neigh show dev enp0s31f6 | awk '/e4:5f:01:e9:13:96/{print $1}')
+sshpass -p beacon ssh user@$CM4   # login: user / beacon
+```
+
+## OTA Update
+```bash
+# transfer (scp broken on Dropbear — use tee pipe):
+sshpass -p beacon ssh user@$CM4 'sudo tee /upload/rootfs.raucb >/dev/null' \
+  < output/images/rootfs.raucb
+# install + reboot:
+sshpass -p beacon ssh user@$CM4 'rauc install /upload/rootfs.raucb && sudo reboot'
+# after reboot — find new IP, then:
+sshpass -p beacon ssh user@$CM4 'rauc status mark-good && rauc status'
+```
+
+## UART
+```bash
+picocom -b 115200 /dev/ttyUSB1                          # interactive (GPIO14/15)
+socat -u /dev/ttyUSB1,b115200,rawer,crnl OPEN:/tmp/uart.log,creat,trunc &  # headless capture
+```
+
+## Rescue
+Short GPIO4 (pin 7) → GND (pin 9) during power-on → boots `/dev/mmcblk0p2`.
+
+## Secure Boot (Milestone 2)
+```bash
+update-pieeprom.sh -k private.pem && rpiboot -d secure-boot-recovery
+```
+> Use existing `private.pem` — never regenerate it.