Document REST ingestion API key pairing in AGENTS.md

Clarify ISSUE_CORE_API_KEY startup requirement, local dev flow, and that
agents must not request the key from ops-warden.

AGENTS.md

@@ -101,6 +101,32 @@ curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
 
 ---
 
+## REST ingestion API key
+
+`POST /issues/` requires a shared key in `ISSUE_CORE_API_KEY`. The server
+refuses to start without it. activity-core's `IssueCoreRestSink` sends the same
+value as `Authorization: Bearer <key>` (also accepts `X-API-Key`).
+
+**Do not request this key from ops-warden** — pair env vars locally or via
+OpenBao/K8s on both repos. Routing lookup:
+`warden route show activity-core-issue-sink --json`.
+
+**Local dev:**
+
+```bash
+export ISSUE_CORE_API_KEY="$(python3 -c 'import secrets; print(secrets.token_urlsafe(32))')"
+issue serve --host 127.0.0.1 --port 8765
+```
+
+Set the same `ISSUE_CORE_API_KEY` in activity-core when `ISSUE_SINK_TYPE=rest`.
+For local ingest smoke, set `default: local` in `~/.config/issue-tracker/backends.json`
+— a remote Gitea default backend will hang on `POST /issues/`.
+
+See `README.md` (REST Ingestion Server) and activity-core
+`docs/issue-core-emission-boundary.md`.
+
+---
+
 ## Workplan Convention (ADR-001)
 
 Work items originate as files in this repo — not in the hub. The hub is a