Update ACCOUNTS.md account standard [skip ci]

ACCOUNTS.md

@@ -0,0 +1,22 @@
+# JK-Git accounts and machine access
+
+| Identity | What it records | Where it is used |
+| --- | --- | --- |
+| One SSH deploy key per machine | Which machine pushed; write access only to its assigned repos | Created and kept on the machine. jr-run adds only its public half to the repos it needs; dev machines get every repo. It cannot push a protected branch. |
+| Commit name and email | Who worked: `claude-agent`, `codex-agent`, or `westtexasfish` | Claude and Codex settings set their own commit names. A commit name is a label, not proof. |
+| West Texas Fish's own device key | His own pushes and protected-branch bypass | Only his PCs, registered on the `westtexasfish` Gitea account. Never on servers. |
+| `jr-team_agent` / `jr-team-review_agent` | JR-Team coding and PR review | Only on jr-team (CT 107), through Paperclip's own access. |
+| `jr-run` | Repository, machine-key and PR standard jobs | Site-admin automation on jr-run (CT 210). |
+| `claude-agent` / `codex-agent` Gitea accounts | JK-Git MCP review comments and Claude cloud sessions | These accounts do not push from lab machines. |
+
+Your Git setup comes from the machine you are on. Push your branch when it is
+ready: jr-run opens a PR automatically, requests and assigns
+`jr-team-review_agent`, and enables auto-merge after approval. Name a branch
+`wip/...` to save unfinished work without opening a PR. Do not change Git
+identity, keys or remotes, do not run setup scripts, and never ask anyone to
+make a key.
+
+On the jr-team server, JR-Team agents push as `jr-team_agent` and open their
+own PRs. Request review from `jr-team-review_agent` and turn on auto-merge.
+The PR Reviewer reviews; it does not push or merge. The source branch is
+removed after merge.