chore(scope): enforce Fusion-ships-to-dev-only rule; remove prod-targeted e2e cruft

Fusion is allowed to ship to dev.sase.tr (staging) only — the user owns
the dev→main GitHub merge that promotes to production. Heartbeat-created
tasks kept hallucinating prod deploys / monitoring (FN-291 / 315 / 323 /
324 / 311 etc.), and an entire e2e suite targeting live sase.tr was merged
under FN-320 with hardcoded test creds.

Changes:
- Add "Project-wide rule: Fusion ships to dev.sase.tr only" block to all
  7 agent personas (ceo/cto/cpo/designer/qa/backend-eng/frontend-eng).
- Add /AGENTS.md at project root as the canonical rule (loaded once
  pi-markdown-workflows is reinstalled in the container).
- Remove production-targeted e2e suite under apps/web/e2e/ (auth.setup.ts,
  deployment-audit.cjs, p0-subscription-cro.spec.ts, p0-subscription-cro-verify.cjs,
  playwright.config.ts, screenshots/).
- Remove docs/product/funnel-monitoring-p0-cro-post-deploy-2026-05.md
  (prod-monitoring deliverable, out-of-scope).
- Subscription downgrade-offer dialog: avoid mobile-viewport overflow by
  capping width at calc(100vw - 2rem) below sm breakpoint
  (formerly attempted in failed/duplicate FN-291/295).

AGENTS.md

@@ -0,0 +1,46 @@
+# Fusion Agent Operating Rules — sase.tr
+
+This file is auto-loaded into every Fusion agent's context (via `pi-markdown-workflows`). It defines project-wide constraints that override per-persona instructions.
+
+## Deployment scope (CRITICAL)
+
+**Fusion only ships to `dev.sase.tr` (staging).** Production deploys to `sase.tr` (main branch) are **human-only**.
+
+The pipeline:
+
+```
+Fusion agent → merge to local `dev` → push to `github/dev` → Coolify → dev.sase.tr (staging)
+                                                                          ↓
+                                                       HUMAN reviews on dev.sase.tr
+                                                                          ↓
+                                                       HUMAN opens GitHub PR: dev → main
+                                                                          ↓
+                                                       GitHub Action → PM2 → sase.tr (prod)
+```
+
+The user merges `dev → main` manually on GitHub when they decide the staging build is ready. Fusion has no role in that step.
+
+### Do NOT create tasks that:
+
+- "Deploy X to production" / "Push X to sase.tr" / "Trigger PM2 restart"
+- "Production bundle is missing key Y" / "Live site does not have feature Z" — production lag is **expected and intentional**; it reflects the unmerged dev→main gap, not a bug.
+- "Run CI/CD pipeline to ship the FN-NNN bundle to prod"
+- Any task whose acceptance criterion is "verified on sase.tr" (use dev.sase.tr instead)
+
+If verification on staging passes, **the task is done.** Do not chase whether the change reached production — that's the user's call.
+
+### Acceptable verification targets
+
+- `dev.sase.tr` — staging, where Fusion's work lands
+- Local worktree + `pnpm test` — for unit/integration coverage
+- Local `pnpm dev` — for visual/manual checks
+
+### Acceptable escalation
+
+If you genuinely believe a staged change needs to reach production urgently, use `fn_send_message({to: "user"})` with a one-line summary. Do NOT create a Fusion task for it.
+
+## Branch policy
+
+- Fusion always works against `dev`. Worktrees branch from `dev`. Merges target `dev`.
+- Never push to `github/main` or `origin/main`.
+- Never create a PR from `dev` to `main` — that is the user's manual step.