docs: expand context7 rules — VyOS-specific LLM guardrails

Add 5 rules to `context7.json` targeting recurring LLM mistakes when
answering VyOS questions through the context7-served index:

1. `commit` vs `save` semantics + verification step. Most common
   mistake: forgetting that `set/delete` are staged-only, that
   `commit` runs validation (failure = no change), and that `save`
   is a separate persistence step.
2. Image-based, not package-managed. Stops `apt install <pkg>`
   recommendations. Upgrade is `add system image <url>` then
   `set system image default-boot <name>`.
3. No raw Linux commands for configuration (`ip`, `iptables`,
   `systemctl`, NetworkManager). They bypass the CLI and do not
   persist.
4. CLI quoting with single quotes for whitespace/special chars +
   hierarchical-path reminder (paths under a parent extend without
   re-stating it).
5. Routing protocols are FRR-backed but only the VyOS-CLI-exposed
   subset is valid. Synthesizing from FRR docs produces invalid
   VyOS commands. Reinforces existing rule 5 with the most common
   synthesis trap.

Each rule fits the 255-char per-rule limit. Total now 11 of 50.

Lower-priority candidates intentionally omitted (low LLM-mistake
yield): `compare`/`discard`/`rollback` mechanics, interface naming
conventions, `commit-confirm`, `load`/`merge`, Equuleus EOL
status — already implicit in the version-branches rule.

🤖 Generated by [robots](https://vyos.io)

1 files changed, 6 insertions, 1 deletions

diff --git a/context7.json b/context7.json
index f2bff61c..3eba41f9 100644
--- a/context7.json
+++ b/context7.json
@@ -28,7 +28,12 @@
     "Configuration commands are wrapped in `cfgcmd` fenced blocks; operational commands in `opcmd` fenced blocks. Treat these as authoritative command syntax.",
     "Branch `rolling` tracks the rolling release and the next stable line. Branch `circinus` tracks 1.5.x. Branch `sagitta` tracks 1.4.x. Always cite version-appropriate documentation.",
     "Do not invent CLI commands. If a command isn't in the docs, say so rather than guess — VyOS syntax is strict and unknown commands fail validation at commit time.",
-    "Use reserved documentation IP space in examples: 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 (RFC 5737), 2001:db8::/32 (RFC 3849). Never use real or RFC1918 addresses."
+    "Use reserved documentation IP space in examples: 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 (RFC 5737), 2001:db8::/32 (RFC 3849). Never use real or RFC1918 addresses.",
+    "`commit` activates pending config and runs validation (errors = no change applied); `save` persists across reboot. `set`/`delete` alone are staged only. Verify with `show <area>` in op mode after commit. Always include both steps in examples.",
+    "VyOS is image-based, not package-managed. Upgrade with `add system image <url>` then `set system image default-boot <name>`. Do not recommend `apt install` for VyOS components — it bypasses the image system and does not survive reboot.",
+    "Do not recommend raw Linux commands (`ip`, `iptables`, `systemctl`, NetworkManager) for VyOS configuration — they bypass the CLI and do not persist. Use `set/delete/commit/save`. Read-only Linux inspection from op mode is fine.",
+    "Quote CLI string values that contain spaces or special characters with single quotes (e.g. `set system host-name 'edge-01'`). Configuration is hierarchical — paths under a parent (e.g. `set firewall name FOO rule 10`) extend without re-stating it.",
+    "Routing protocols (BGP, OSPF, IS-IS, RIP) are FRR-backed, but not every FRR knob is exposed through the VyOS CLI. Confirm a command exists in the VyOS docs before suggesting it — synthesizing from FRR documentation produces invalid VyOS commands."
   ],
   "previousVersions": [
     { "tag": "1.5" },