docs: add agent guidance and historical audit report

Add root AGENT.md with project conventions, build verification steps,
source layout, style rules, and real-time/concurrency requirements.
Add per-module AGENT.md files for each existing and proposed source
subdirectory. Add AUDIT_REPORT.md as a historical Phase 1 snapshot
documenting memory management, error handling, concurrency model,
naming conventions, and anti-pattern catalog.

Source/plugin/AGENT.md

@@ -0,0 +1,41 @@
+# plugin module
+
+## Related source files
+
+This directory contains guidance; the implementation remains in
+`../PluginProcessor.h` and `../PluginProcessor.cpp`.
+
+## Rules
+
+- Keep this the JUCE `AudioProcessor` boundary: APVTS, engine, RAVE, presets and state.
+- Declare the full parameter layout in `createParameterLayout()`.
+- Use `juce::ScopedNoDenormals` in `processBlock`.
+- Guard `getRawParameterValue` and `getParameter` results before dereferencing them.
+- Return silently on null or invalid state XML and invalid ValueTrees.
+- Use raw `new` only for JUCE-owned objects (`createEditor`, `createPluginFilter`).
+- Prefer const accessors over the public `parameters`, `engine` and `rave` fields for new code.
+
+## IF-THEN
+
+- IF state XML is null or invalid THEN return without touching the APVTS.
+- IF a parameter is missing from a preset load THEN skip it with an `if (auto* param = ...)` guard.
+
+## Examples
+
+```cpp
+// BAD: dereferences a possibly null XML result
+auto xml = getXmlFromBinary (data, size);
+auto state = juce::ValueTree::fromXml (*xml);
+```
+
+```cpp
+// GOOD: null guard, silent return
+std::unique_ptr<juce::XmlElement> xml (getXmlFromBinary (data, size));
+if (xml == nullptr)
+    return;
+juce::ValueTree state = juce::ValueTree::fromXml (*xml);
+if (! state.isValid())
+    return;
+```
+
+This file overrides /AGENT.md where they conflict.