fix: address adversarial-review findings (validate error visibility + portable paste snippets)

- validate.yml: stream curl output directly; the response=$(...) capture under
  set -euo pipefail swallowed the validation error body on non-2xx (job failed
  with a bare exit code and no explanation)
- AGENTS.md + README.md: quote the ?ref=production endpoint (zsh globs bare ?)
  and fetch via Accept: application/vnd.github.raw instead of jq + base64
  (BSD/GNU base64 flag drift)

codecov.yml payload unchanged (byte-frozen to spec Appendix B).

T9078: IS-609

🤖 Generated by [robots](https://vyos.io)

1 files changed, 3 insertions, 3 deletions

diff --git a/README.md b/README.md
index f8c0125..1d8a22e 100644
--- a/README.md
+++ b/README.md
@@ -18,8 +18,8 @@ delta is enumerated in the per-org delta table below — never as comments in `c
    `https://codecov.io/validate`. The check must pass.
 3. After merge to `production`:
    ```bash
-   gh api repos/vyos/codecov/contents/codecov.yml?ref=production \
-     --jq '.content' | base64 -d
+   gh api 'repos/vyos/codecov/contents/codecov.yml?ref=production' \
+     -H "Accept: application/vnd.github.raw"
    ```
    Operator pastes this content into the dashboard editor (linked above), saves,
    and re-opens the tab to confirm the saved content matches.
@@ -27,7 +27,7 @@ delta is enumerated in the per-org delta table below — never as comments in `c
 ## Paste protocol (operator)
 
 1. Open https://app.codecov.io/account/gh/vyos/yaml in browser.
-2. Fetch the merged file via `gh api ... | base64 -d` (above).
+2. Fetch the merged file via the quoted `gh api` raw-content command (above).
 3. Paste into the dashboard editor.
 4. Save.
 5. Re-open the dashboard tab. **Codecov strips comments** — the saved content