docs: sync AGENTS.md with current project state

Root flake is canonical, assets resolve relative to the working
directory, and the CI live-test secrets were renamed RW_LIVE_* to
RWT_LIVE_* (plus the new RWT_LIVE_ACCOUNT_EMAIL/LICENSE_* keys).

AGENTS.md

@@ -42,13 +42,20 @@ The portal API key is also a build-time argument: `-DAPI_KEY="..."` (CMake) or
 real value in CI secrets, never in source — rotate by rebuilding with a new
 key.
 
+- The app resolves `assets/...` relative to its working directory — launch
+  `./build/radiantwave` from the repo root. (The Nix wrapper chdirs to
+  `$out/share/radiantwave` before exec, which is why the installed app works.)
 - Development happens on macOS; WiFi/D-Bus code is Linux-only, but
   `NetworkManager::hasInternet()` (a raw TCP probe) works everywhere, so the
   provisioning walkthrough does not trap a Mac on the WiFi page.
 - The app creates a **1920x1080 fullscreen** window with VSync and a hidden
   cursor. `~/.local/radiantwave/config.yaml` (YAML) and
   `~/.local/radiantwave/radiantwave.db` (SQLite, WAL) are created at first run.
-- No root `flake.nix` exists; the Nix flake in `archive/` is reference only.
+- The root `flake.nix` is canonical: `packages.default`, `devShells.default`,
+  `checks.<system>.default` (the package; its `checkPhase` runs the offline
+  test suite), a `nixosModules.default`, and `nix build
+  .#packages.x86_64-linux.test-vm`. `archive/` holds the previous Go
+  implementation — reference only, do not modify.
 
 ---
 
@@ -219,9 +226,11 @@ cached.
   and `main`. It runs `nix build -L .#checks.<system>.default` (build + the
   offline test suite; `checks` is keyed per-system, so the workflow resolves
   the current system via `nix eval --impure --expr 'builtins.currentSystem'`);
-  when the `RW_LIVE_API_KEY` secret is set it also runs
+  when the `RWT_LIVE_API_KEY` secret is set it also runs
   `test_api_client` / `test_license_service` against the portal via
-  `nix develop` (outside the sandbox, like a dev machine).
+  `nix develop` (outside the sandbox, like a dev machine). Those live tests
+  also need `RWT_LIVE_ACCOUNT_EMAIL`, `RWT_LIVE_LICENSE_EMAIL`, and
+  `RWT_LIVE_LICENSE_KEY`.
 - `test_assets` must pass before committing — it catches missing fonts/images
   that break the app at runtime.
 - `cmake --build build` builds everything; pass `--target <name>` to build one