docs: note ~/.local/bin/jerboa path in AGENTS.md

ober

1564468966f307cb715571f8479512967eaecbfd

diff --git a/AGENTS.md b/AGENTS.md
index 4789b6b..aba05ec 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -17,7 +17,7 @@ Every Jerboa file looks like this:
 (displayln (my-function 1 2))
 ```
 
-Run with: `jerboa run file.ss`
+Run with: `~/.local/bin/jerboa run file.ss` (or `jerboa run file.ss` if `~/.local/bin` is on your PATH).
 
 **NEVER** write `(library ...)` forms — that's `.sls` internal syntax.
 
@@ -348,6 +348,23 @@ Common sibling repos that exist but must NOT be touched without explicit instruc
 
 If a user instruction mentions a file path, use EXACTLY that path. Do not substitute a similar-looking path from another repo.
 
+### Never Reference Sibling Checkouts in Build Files
+
+Build files (Makefile, shell scripts, CI config) must **never** resolve a
+dependency via a relative sibling path (`../jerboa-foo`) or an absolute
+`~/mine/jerboa-foo` path. That layout is specific to this one machine —
+other users and CI do not have it. Always vendor instead: fetch/clone the
+dependency into `vendor/` (or this repo's equivalent) at build time, or use
+a pinned-release fetch script, so the build is reproducible without
+assuming any sibling checkout exists.
+
+A sibling-path fallback is not just a portability bug: it can silently
+substitute a full alternate source tree (build config, embedded data,
+secrets) for the vendored one, with no equivalent safety default, changing
+what actually gets built without any indication. If you find one
+(`grep -rn '\.\./jerboa\|~/mine/jerboa'` over Makefiles/scripts), remove it
+and vendor properly instead.
+
 ---
 
 ## Build & Verification