loops: mandate machine-docs/ for ALL coordination files (kickoff/prompts/plan/AGENTS)

Recent phases wrote STATUS/BACKLOG/REVIEW/JOURNAL to the repo ROOT because
build_kickoff + plan.md's tree used bare filenames, even though the loops'
AGENTS.md + INBOX/DECISIONS/DEFERRED conventions already said machine-docs/.
Make machine-docs/ the single mandated home everywhere: build_kickoff now
emits machine-docs/ paths + an explicit FILE-LOCATION RULE; both loop prompts
and plan.md (tree + seed step) updated; orchestrator AGENTS.md documents +
enforces it. resolve_state/INBOX handoff already read machine-docs/ first.

AGENTS.md

@@ -62,6 +62,16 @@ Use it to: tail loop logs (`cc-ci-plan/launch.sh logs builder|adversary|watchdog
 power-cycle/recreate the cc-ci VM (see `cc-ci-plan/kickoff.md` → "Fallback: restart/recreate the
 cc-ci VM"). The orchestrator is the human's steering wheel; the loops are the engine.
 
+## Loop file-location rule (machine-docs/)
+
+In the **cc-ci loops repo**, ALL coordination / loop-state files live under `machine-docs/`, NEVER
+the repo root: phase-namespaced `STATUS-*.md` / `BACKLOG-*.md` / `REVIEW-*.md` / `JOURNAL-*.md`,
+shared `DECISIONS.md` / `DEFERRED.md`, and the `ADVERSARY-INBOX.md` / `BUILDER-INBOX.md`
+side-channels. This is enforced in the kickoff (`launch.py build_kickoff`), the loop prompts, and
+the loops' own `AGENTS.md`. If the orchestrator ever sees such a file at the root, move it into
+`machine-docs/` and check the kickoff/prompts still mandate it. (The watchdog's `resolve_state` and
+INBOX handoff already read `machine-docs/` first, so this is the single canonical home.)
+
 ## Launch & supervise the loops
 
 - **Source of truth for the loops:** `cc-ci-plan/plan.md` (mission, Definition of Done, §1.5