docs(agents): state the base/overlay rule by scope, not as immutability

AGENTS.md

@@ -275,7 +275,7 @@ Secrets* above and the rules under *Validate before any manifest PR* below.
 - **Draft PRs** — always create PRs as drafts.
 - **Small, focused changes** — one concern per PR.
 - **Never commit plaintext secrets** — all secrets must be SOPS-encrypted with the `.enc.yaml` suffix.
-- **Base files are immutable** — use Kustomize `patches:` in overlays; never edit `k8s/bases/` directly from a provider or cluster overlay.
+- **Put a change in the layer that matches its scope** — edit `k8s/bases/` when it should hold for **every consumer of that resource**; add an overlay `patches/` fragment only for a genuine per-consumer difference. "Every consumer" is **not** "every cluster": much of `k8s/bases/` has a single consumer today by design, since the local Docker overlay opts *in* to apps and heavier infrastructure rather than deploying them. A shared component's canonical configuration still belongs in its base — patching it into the one provider that happens to use it today leaves the base stale for whoever opts in next. Bases are shared, not frozen: editing them is the ordinary case, not an exception — `k8s/bases/` changes in about half of all commits, far more often than the overlays it feeds. What to avoid is mutating a base to obtain a *per-overlay* result — that silently moves every other consumer with it. One question decides it: **would every consumer of this resource want the change?** If yes, the base is correct.
 - **Flux dependency order** — `bootstrap` → `infrastructure-controllers` → `infrastructure` → `apps`. One prod-only side layer hangs off `infrastructure` without gating `apps`: `infrastructure-overprovisioning` (apply-only autoscaler buffer). Declarative GitHub org management runs as a normal **app** (`github-config`) consuming the `devantler-tech/.github` artifact, with its Crossplane provider in the `infrastructure` layer — see [`docs/github-management.md`](docs/github-management.md).
 - **File & directory naming** — kebab-case folders, one resource per file, and filenames led by the resource Kind (CR folders and `patches/` excepted — both name files by intent). Talos machine-config patches (`talos/`, `talos-local/`) also hold one document per file with intent names; only the k8s-manifest-specific rules don't apply to them. Enforced by the `naming` CI job. See [File and Directory Naming Conventions](#file-and-directory-naming-conventions) below.
 
@@ -412,7 +412,7 @@ These conventions guide the autonomous **Daily AI Assistant** — and any agenti
 - **Edit in place with the non-printing primitives**, never a decrypt→edit→encrypt round-trip: `sops set <file> '["key"]' '"value"'` and `sops unset` change a value without emitting the document; `sops updatekeys <file>` re-encrypts to new recipients after a `.sops.yaml` change.
 - **Verify a file is still ENCRYPTED before you stage it.** It must contain a `sops:` metadata block and `ENC[AES256_GCM,` values. If either is missing it is plaintext — do NOT stage it.
 - **`.decrypted*` is gitignored (`.gitignore:16`) and no such file has ever been committed. Keep it that way:** never `git add -f` one, never remove that ignore rule, and stage explicit paths only (never `git add -A`).
-- **If plaintext ever reaches git or a transcript, the secret is COMPROMISED** — revoke immediately (containment outranks continuity), then sweep every copy per the monorepo `AGENTS.md` credential-rotation rule. Do not quietly fix it up. **bases immutable** — change via Kustomize `patches:` in overlays, never edit `k8s/bases/` from an overlay; respect Flux order `bootstrap → infrastructure-controllers → infrastructure → apps`.
+- **If plaintext ever reaches git or a transcript, the secret is COMPROMISED** — revoke immediately (containment outranks continuity), then sweep every copy per the monorepo `AGENTS.md` credential-rotation rule. Do not quietly fix it up.
 
 **Task menu** (pick 2–3; favour the "What's Useful for the AI Assistant" items):
 - **Triage & label** unlabelled issues/PRs; remove misapplied labels; close obvious spam.