docs: add AGENTS.md index and inherit org SECURITY.md

[singlerider]

Part of blacklanternsecurity/bbot-enterprise#157.

• AGENTS.md: what the repo is, toolchain, setup, test commands, an index of the org standards with when to read each, and only facts specific to this repo. Versions are referenced in the manifest, not retyped.
• CLAUDE.md points at AGENTS.md.
• Setup documents the venv, pip, and maturin flow CI uses, since [tool.uv] managed = false makes uv sync fail.
• SECURITY.md removed so the org default applies.

Validation

$ git diff --stat upstream/dev
  AGENTS.md   | 47 +++++++++++++++++++++++++++++++++++++++++++++++
  CLAUDE.md   |  1 +
  SECURITY.md | 16 ----------------
  3 files changed, 48 insertions(+), 16 deletions(-)
$ ./scripts/build-openssl.sh && python -m venv .venv && . .venv/bin/activate
$ pip install --upgrade pip maturin && pip install --group dev && maturin develop
Installed blasthttp-0.10.0
$ pytest -q
162 passed in 17.96s

Standards links point at blacklanternsecurity/.github/blob/main/standards. They resolve once the standards land in .github and it is made public (admin step).

Refs blacklanternsecurity/bbot-enterprise#157

[en0f]

Approved, but some potential blockers:

Both come from things the PR relies on that don't exist yet in blacklanternsecurity/.github.

Deleting SECURITY.md leaves the repo with no security policy. The org .github repo has nothing to inherit from: its main branch holds only .github/workflows, workflow-templates and README.md. The PR branch has no .github/SECURITY.md or docs/SECURITY.md either. If this merges, blasthttp has no vulnerability disclosure policy at all. Either the org SECURITY.md has to land first, or this PR needs to keep the file.
All 8 standards links in AGENTS.md lead to 404s. There's no standards/ folder in the org .github repo, and no open PR there adds one. The "principles.md: Always" line sends agents to a page that doesn't exist. Same fix: merge the standards first, or hold this PR until they exist.