docs: record Hermes Matrix reconfiguration

AGENTS.md

@@ -15,6 +15,10 @@ Also readable as `agent.md` (symlink → this file).
 6. Default SSH access (`ssh -4 windy@<host>`) is for focused diagnostics,
    imperative upstream procedures, and incident work. Prefer **IPv4** from this
    WSL client (AAAA often exists but IPv6 route does not).
+7. Record each material VPS operation, incident, configuration change, or
+   verification outcome in the corresponding **Linear `vps` project**. Include
+   scope, action, verification, and remaining follow-up; never put passwords,
+   tokens, private keys, recovery keys, or private room IDs in Linear.
 
 ## Active hosts (quick map)
 
@@ -63,6 +67,7 @@ Also readable as `agent.md` (symlink → this file).
 | PowerDNS upstream refs | [docs/pdns-upstream.md](docs/pdns-upstream.md) |
 | Matrix health | [runbooks/matrix-health.md](runbooks/matrix-health.md) |
 | Matrix upstream refs | [docs/matrix-upstream.md](docs/matrix-upstream.md) |
+| Hermes Agent Matrix channel | [docs/hermes-matrix.md](docs/hermes-matrix.md) |
 | Routine Ansible operations | [runbooks/ansible-operations.md](runbooks/ansible-operations.md) |
 
 ```bash