- agent-identity-conventions.md: new "ActorID vs UserID in Group Chats"
section with helper table, group behavior table, propagation chain
diagram, group permission policy, legacy-data tolerance notes.
- 17-changelog.md: entry covering the security fix, propagation
additions, ACTOR migration list, scope-intentional sites, tests,
and the no-DB-migration decision with its legacy-fallback rationale.
Distills the dual-identity rules from the agent identity hardening work
into a single permanent reference. Covers all 5 trap zones with post-
hardening status, batch fail-fast contract change, router cache
canonicalization, FK safety net, telemetry type-layer defense, and
dual-tenant agent_key semantics. Adds a CLAUDE.md pointer under Key
Patterns so contributors find it via the standard onboarding path.