fix: preserve tracked dist/.gitkeep across clean cycles

Commit 6472890 accidentally deleted the committed dist/.gitkeep: the
clean-state test ran 'rm -rf dist' (which contains the tracked .gitkeep)
and the following 'git add -A' recorded the deletion. Fresh clones then
had no dist/ and 'go build'/'just check' failed before the first shiroa
run ('pattern all:dist: no matching files found').

- Justfile: 'clean' now recreates dist/.gitkeep, so the tracked file
  survives clean/build cycles.
- AGENT.md: clean-state procedure uses 'just clean' and requires a clean
  'git status' after test cycles, with the reason documented.
- Verified: with dist/ holding only .gitkeep, 'go build' and 'go vet'
  succeed (fresh-clone state).

AGENT.md

@@ -12,7 +12,8 @@ the user wins.
 - `just build` — parse ACL, compile the book, build `./server`.
 - `just run` — build everything, then serve on :8080.
 - `just check` — go vet, go test, gofmt. Run it before every commit.
-- `just clean` — removes `dist/` and `server` (keeps `tools/`).
+- `just clean` — removes `dist/` and `server` (keeps `tools/` and
+  restores the committed `dist/.gitkeep`).
 - The shiroa toolchain is pinned and self-bootstrapped into `tools/` by the
   `tools` recipe. Never assume a global shiroa/typst install exists; do not
   install shiroa globally; do not bump the pin casually (see Traps).
@@ -64,8 +65,11 @@ the user wins.
 ## Testing expectations
 
 - Test what the user runs, not a proxy for it: from a clean state
-  (`rm -rf tools dist server`), `just build` and `just run` must succeed
-  with no global shiroa on PATH. Test the bare `just` output too.
+  (`rm -rf tools && just clean`), `just build` and `just run` must succeed
+  with no global shiroa on PATH. Test the bare `just` output too. After
+  any clean/test cycle, `git status` must be clean: `dist/.gitkeep` is
+  tracked, and committing a worktree where it is missing breaks fresh
+  clones (`go:embed` needs `dist/`).
 - Server behavior: curl a public page (200), a protected page (503 without
   OIDC env; it must never serve protected content), and `/searchindex.json`
   (404). Extend the unit tests in `internal/acl` and `internal/middleware`

Justfile

@@ -46,6 +46,6 @@ check:
 	go test ./...
 	@test -z "$(gofmt -l cmd internal embed.go)" || { echo 'gofmt needed:'; gofmt -l cmd internal embed.go; exit 1; }
 
-# Remove build artifacts (keeps tools/, the committed acl.json and dist/.gitkeep).
+# Remove build artifacts (keeps tools/ and the committed dist/.gitkeep).
 clean:
-	rm -rf dist server
+	rm -rf dist server && mkdir -p dist && touch dist/.gitkeep