fix: address adversarial-review findings (validate error visibility + portable paste snippets)

- validate.yml: stream curl output directly; the response=$(...) capture under
  set -euo pipefail swallowed the validation error body on non-2xx (job failed
  with a bare exit code and no explanation)
- AGENTS.md + README.md: quote the ?ref=production endpoint (zsh globs bare ?)
  and fetch via Accept: application/vnd.github.raw instead of jq + base64
  (BSD/GNU base64 flag drift)

codecov.yml payload unchanged (byte-frozen to spec Appendix B).

T9078: IS-609

🤖 Generated by [robots](https://vyos.io)

0 files changed, 0 insertions, 0 deletions