CI check over .md files in root folder

[dhruv8sh]

Summary

• Extend the format-docs CI job to check root-level Markdown (AGENTS.md, README.md, FAQ_POC.md, etc.) with Prettier, closing the gap where only docs/ was covered
• Normalize existing formatting drift in the three root files that were failing (AGENTS.md, FAQ_POC.md, ProjectGovernance.md) — whitespace/list-marker only, no content changes
• Document the new gate in AGENTS.md's CI Gates checklist

Changes

File	Change
.github/workflows/format.yml	Added a step to the format-docs job that runs docs/node_modules/.bin/prettier --config docs/.prettierrc --check "*.md" from the repo root, reusing the already-installed binary and the existing docs/.prettierrc config
AGENTS.md	Reformatted (Prettier drift only); added item 8 to the CI Gates list documenting the new root-Markdown check
FAQ_POC.md	Reformatted (Prettier drift only)
ProjectGovernance.md	Reformatted (Prettier drift only)

Closes #1093

Test plan

• Docs format: cd docs && npm run format
• Root Markdown format: docs/node_modules/.bin/prettier --config docs/.prettierrc --check "*.md" (run from repo root)
• Ran the format-docs and check-claude-md-symlink GitHub Actions jobs locally via act — both pass, including the new step
• Verified CLAUDE.md still resolves as a symlink to AGENTS.md (git ls-tree mode 120000) after formatting AGENTS.md
• cargo test-fastly && cargo test-axum
• cargo clippy-fastly && cargo clippy-axum
• cargo fmt --all -- --check
• JS tests: cd crates/trusted-server-js/lib && npx vitest run
• JS format: cd crates/trusted-server-js/lib && npm run format
• WASM build: cargo build --package trusted-server-adapter-fastly --release --target wasm32-wasip1
• Manual testing via fastly compute serve
• Other: docs-only change, no Rust/JS code touched — Rust/JS gates are unaffected and not re-run

Checklist

• Changes follow AGENTS.md conventions
• No unwrap() in production code — use expect("should ...")
• Uses tracing macros (not println!)
• New code has tests — N/A, CI workflow change and Markdown-only edits
• No secrets or credentials committed

[prk-Jr]

Review: approve with nits

Verified the gate empirically in a scratch worktree at the PR head (71264e87):

• The gate has teeth. Run against main's root .md tree it exits 1 (AGENTS.md, CLAUDE.md, FAQ_POC.md, ProjectGovernance.md warned); run against this PR's tree it exits 0 (All matched files use Prettier code style!).
• Correct binary. docs/node_modules/.bin/prettier is the lockfile-pinned 3.8.1 (docs/package-lock.json), not npx — which in this repo resolves a different version and produces false format failures. The step also sits after npm ci in the same job, so the binary exists, and working-directory: . resolving to the workspace root matches the in-file precedent of the "Retrieve Node.js version" step.
• Glob coverage is complete. Copying all 7 regular root .md files plus a real CLAUDE.md -> AGENTS.md symlink into a scratch dir and appending a violation to each regular file warns on exactly 7 files. So README.md, CONTRIBUTING.md, CHANGELOG.md and TESTING.md are covered by the glob and were already compliant; nothing that should be covered is missed. CLAUDE.md is correctly skipped (prettier does not follow the symlink), so AGENTS.md isn't checked twice — and the dedicated symlink-guard job runs first anyway.
• No ignore-file interference. No root .prettierignore; docs/.prettierignore isn't on the cwd path for this invocation; .gitignore has no .md entries.
• Content changes are formatting-only. proseWrap: "preserve" means no reflow: AGENTS.md is table realignment plus the new checklist entry, ProjectGovernance.md is * → - bullet markers, FAQ_POC.md is trailing-whitespace and double-space collapse. No semantic drift.

Nothing blocking. Four non-blocking notes inline, plus two things outside the diff:

• *.md is non-recursive, which matches the PR title, but it leaves 19 tracked Markdown files ungated (.github/pull_request_template.md, four crate README.mds, 14 files under .claude/). Fine to defer — worth an issue if the intent is eventually "all Markdown is formatted".
• Is format-docs a required status check? I couldn't read branch protection. If it isn't required, this gate is advisory only.

Both inline suggestions were applied in isolation and as a batch against a scratch worktree and re-verified green (exit 0, no drift), then reverted.

[ChristianPavilonis]

Summary

Reviewed 1851e98101e68c17d900506c2ad0ac145dd6dbb7 against 6cae7f5da8911c746cf873581885f90c3820dd96. No actionable issues found.

The new root-Markdown check passed in the exact PR workflow. A separate negative test with the lockfile-pinned Prettier 3.8.1 rejected deliberately malformed copies of all seven regular root .md files, while CLAUDE.md remained a symlink to AGENTS.md. All reported CI checks pass, and the active main ruleset requires format-docs.