docs: enforce read-only remote workflow

modules/capabilities/ai.nix

@@ -131,6 +131,15 @@ in
         # Context
 
         Every action must justify its context. Minimize tools and skills; prefer targeted queries and bounded output. Ask for readily available large output instead of retrieving it.
+
+        # Remote state
+
+        GitHub and all other repository remotes are strictly read-only. Fetching,
+        cloning, and reading metadata, issues, pull requests, checks, and diffs are
+        allowed. Never push or mutate remote repositories, issues, pull requests,
+        reviews, comments, labels, assignments, projects, workflows, releases,
+        settings, keys, secrets, or variables. Local files and local Git state may
+        be modified as authorized.
       '';
 
       home.file.".codex/skills/nixos-maintainer".source = ./skills/nixos-maintainer;