docs: sync runtime env and security documentation

AGENTS.md

@@ -47,6 +47,14 @@
   - `AGENT_SECURITY_ENV_SCRUB`
   - `AGENT_SECURITY_DROP_UID`
   - `AGENT_SECURITY_DROP_GID`
+- Runtime-injected resource context (provided by provisioning; do not set in `.env`):
+  - `AGENT_REPO_ROOT`
+  - `AGENT_WORKTREE_PATH`
+  - `AGENT_WORKTREE_BASE_REF`
+  - `AGENT_PORT_RANGE_START`
+  - `AGENT_PORT_RANGE_END`
+  - `AGENT_PORT_PRIMARY`
+  - `AGENT_DISCOVERY_FILE`
 
 ## Documentation Standards
 - Update `README.md` for user-facing behavior.