docs: Add repository guidelines and code review report

- Add AGENTS.md with comprehensive repository guidelines covering project structure, build/test commands, coding style, testing practices, and commit conventions
- Add REVIEW_REPORT.md documenting code review findings including 4 actionable issues: logging permission errors, incorrect test imports, timezone conversion bugs, and dead error counter code
- Include detailed recommendations for fix prioritization and test evidence from pytest runs
- Provide reference documentation for future development and maintenance workflows

REVIEW_REPORT.md

@@ -0,0 +1,49 @@
+# Code Review Report
+
+## Scope
+- Reviewed Python sources under `src/vlm/`, tests under `tests/`, and docs (`README.md`, `AGENTS.md`).
+- Executed test runs on February 9, 2026:
+  - `pytest -q`
+  - `pytest -q --ignore=tests/test_executor.py --ignore=tests/test_quarantine.py`
+
+## Summary
+- Found 4 actionable issues: 2 high-priority functional problems, 1 medium-priority data correctness issue, and 1 low-priority observability issue.
+- Markdown docs are generally clear; no blocking doc defects were found.
+
+## Findings
+
+### P1 - CLI startup fails when log path is not writable
+- Files: `src/vlm/logging_config.py:63`, `src/vlm/logging_config.py:87`
+- `setup_logging()` unconditionally creates the log directory and rotating file handler.
+- In restricted environments, this raises `PermissionError` and aborts CLI initialization (including read-only commands like `--help`).
+- Impact: broad command/test failure in CI/sandbox/service-user contexts.
+
+### P1 - Test imports use wrong module path
+- Files:
+  - `tests/test_executor.py:13`
+  - `tests/test_executor.py:14`
+  - `tests/test_quarantine.py:8`
+  - `tests/test_quarantine.py:9`
+  - `tests/test_quarantine.py:10`
+- Tests import `src.vlm...` instead of package imports `vlm...`, causing collection failure (`ModuleNotFoundError: No module named 'src'`).
+
+### P2 - Timestamp conversion is incorrect for naive datetimes
+- Files: `src/vlm/scanner.py:148`, `src/vlm/scanner.py:379`, `src/vlm/scanner.py:437`
+- Naive local timestamps are later relabeled as UTC via `replace(tzinfo=timezone.utc)` instead of converted.
+- Impact: exported timestamps can be shifted by local timezone offset.
+
+### P3 - Scan error counter is dead code
+- Files: `src/vlm/scanner.py:53`, `src/vlm/scanner.py:64`
+- `error_count` is initialized/reported but never incremented.
+- Impact: scan summary underreports error conditions.
+
+## Test Evidence
+- `pytest -q` failed at collection due to `src.vlm` imports in two test files.
+- `pytest -q --ignore=tests/test_executor.py --ignore=tests/test_quarantine.py` reported 34 failures, dominated by logging startup failure:
+  - `PermissionError: [Errno 1] Operation not permitted: '/Users/windy/.vlm/logs/vlm.log'`
+
+## Recommended Fix Order
+1. Make logging setup fault-tolerant (fallback to console-only logging).
+2. Correct test imports to `vlm...`.
+3. Fix timezone handling for inventory timestamps.
+4. Wire scan exception paths to increment `error_count`.