docs: add Copilot Agent Standards

[craigthackerx]

Adds content/docs/documents/copilot-agent-standards.mdx, wired into the sidebar (_meta.ts), the documents index card, and the homepage standards band (auto-discovered as a *-standards.mdx doc, pill reads "Copilot Agent").

Why

"Copilot agent" names five unrelated products. Microsoft 365 Copilot declarative agents, Copilot Studio, SharePoint agents, Security Copilot agents and GitHub Copilot share no manifest format, no limits and no distribution path, so the document names them first and then splits the rules that hold everywhere from the per-platform detail that does not.

Shape

• Ten rules that hold everywhere - definition as code, instructions versus knowledge, retrieved content as data, grounding, least capability, the autonomy ladder, enforcement outside the prompt, cadence off by default, a human sponsor, and testing what a schema cannot.
• Instructions - structure, composition from shared fragments, the budget gate, the output contract, and a complete worked example: the shipped terraform-author agent from libre-devops/copilot-agents at 7,309 of 8,000 characters, with its fragment composition, per-fragment spend, and an annotated read of why each section is where it is.
• Knowledge and grounding - precedence, and why scoped web search cannot see an intranet.
• Per-platform sections - Microsoft 365 Copilot, Security Copilot, GitHub Copilot.
• Identity, governance and lifecycle - Entra Agent ID, sponsors, access packages, Conditional Access, the agent registry.
• Testing, shipping as code, anti-patterns, adoption checklist.

Dating

The document is explicitly dated 24 August 2026 in a status callout at the top and states that it needs updating. A ## Document status section carries a re-verification table with Microsoft's own page dates per source, a known-gaps list, and instructions for whoever refreshes it next.

Verification

• Every platform limit checked against the live documentation rather than written from memory; sources and their ms.date recorded in the document.
• All 22 external links return HTTP 200.
• All 45 internal anchors resolve in the built output.
• npm run build and npm run lint clean locally.
• No em dashes or en dashes.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None