docs: clarify validate trigger scope + document tests/ and scripts/ ignore intent

Review-driven doc-only changes (CodeRabbit round 1 on PR #1):
- AGENTS.md: the validate workflow runs on every PR and on pushes to
  production (the push branch-filter is deliberate; feature-branch
  pushes are covered by the pull_request trigger without duplicate runs)
- README.md: document the intent of the global tests/ and scripts/
  ignore patterns and the per-repo override path

codecov.yml payload unchanged (byte-frozen to spec Appendix B).

T9078: IS-609

🤖 Generated by [robots](https://vyos.io)

2 files changed, 6 insertions, 3 deletions

diff --git a/AGENTS.md b/AGENTS.md
index c81cf6e..8a2dc4c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -6,7 +6,7 @@ This repo holds the **Codecov Global YAML** for the `vyos` GitHub organization.
 - `codecov.yml` — the canonical, comment-free dashboard-paste payload. Mirror of
   `https://app.codecov.io/account/gh/vyos/yaml`.
 - `.github/workflows/validate.yml` — required CI check; POSTs the file to
-  `https://codecov.io/validate` on every PR/push.
+  `https://codecov.io/validate` on every PR and on pushes to `production`.
 - `.mergify.yml` — extends central [vyos/mergify](https://github.com/vyos/mergify).
 - `.coderabbit.yaml` — inherits from [vyos/coderabbit](https://github.com/vyos/coderabbit)
   (`inheritance: true` is mandatory).
diff --git a/README.md b/README.md
index 9b91370..f8c0125 100644
--- a/README.md
+++ b/README.md
@@ -47,8 +47,11 @@ and the `ignore` patterns (`**/*.config.{ts,js,mjs,cjs}`, `**/*.d.ts`, `.next/`,
 are Next.js-derived from the canary in [VyOS-Networks/next-js-vyos](https://github.com/VyOS-Networks/next-js-vyos).
 They are reasonable starting points for JS/TS repos and harmless for non-JS repos (the
 `ignore` patterns simply don't match Python/C++/Ansible paths and the thresholds apply to
-whatever does upload coverage). Repos in other languages that opt into Codecov should
-override numerics in their per-repo `.codecov.yml`.
+whatever does upload coverage). The root `tests/` and `scripts/` patterns are also globally
+ignored: coverage *of* test code and utility scripts is intentionally excluded from
+reporting. A repo whose `scripts/` (or `tests/`) tree holds coverage-bearing product code
+should override the `ignore` list in its per-repo `.codecov.yml`. Repos in other languages
+that opt into Codecov should likewise override numerics in their per-repo `.codecov.yml`.
 
 ## Onboarding a new repo to Codecov coverage