AGENTS, docs, README, tools: mount grants read-only and explain new-app builds

[karalabe]

• tools/run.sh copies the datasets an app declares into a scratch tree without write permission, mounts them from there, and removes the tree on exit. wasmtime lets a guest write to every directory it mounts and has no read-only option, so make run let apps write into fixtures/, while the script's header, AGENTS.md and docs/05-running.md all say the mounts are read-only. A probe app that writes into its granted path now fails with a permission error and leaves the fixtures untouched.
• The README says each table row is a folder under apps/, with the language appended for the minis, and that APP= takes the folder name.
• AGENTS.md runs sh tools/check.sh, as the Makefile and CI do, since none of the scripts under tools/ is executable. It also says a new Rust app commits its own Cargo.lock, since the build runs with --locked, and that one plain cargo build writes it.
• docs/05-running.md says an app kept outside the repository runs against the fixtures with sh tools/run.sh path/to/app.wasm fixtures, and builds with the wasm-opt feature flags in tools/build.sh.
• The README and docs/05-running.md tell AI agents, not scripts, to read ark help agents first.

Agents writing an app from an empty directory mostly built it outside a checkout and had to dig the wasm-opt flags out of tools/build.sh. One lost a build to the missing lock file, one tried tools/check.sh as written and found it not executable, and one noticed the mounts were writable.

Every Rust and Go app still builds, runs against each fixture root and compares equal across languages through tools/check.sh. The C and Python apps were not run here, for lack of wasi-sdk. tools/build.sh still only builds apps inside apps/.