policy: forbid deferred old versions + build-excluded packages (full-fork)

Codify in local/AGENTS.md: every package in a config builds from source/ at the
declared latest version; no stale source/, no mixed versions within a stack, no
commenting a package out of a config to make the build pass. When the auto-rebase
engine rejects a package, re-port it by hand to the new version — never freeze it
at the old one. A deferred old version or excluded package is a build failure to
fix, not a state to ship.

local/AGENTS.md

@@ -714,6 +714,34 @@ This applies to:
 
 **The only acceptable response to an upstream version bump is: update, adapt, commit.**
 
+### No deferred versions — every package at the declared latest
+
+Red Bear OS is a **full-fork distribution**: every package in a config MUST build
+from a `source/` tree at the version its recipe declares, and that version is the
+current latest the whole system targets. There are **no exceptions**:
+
+- **No stale `source/`.** A recipe whose `tar=`/`git=` was bumped but whose
+  vendored `source/` still holds an older version is a bug, not a "deferral."
+  `source/`, `source.tar`, the `.redbear-src-version` stamp, and `[package]
+  version` must all equal the declared version. `verify-external-source-versions.sh`
+  enforces this at preflight/CI; `sync-recipe-source.sh` propagates a bump.
+- **No mixed versions within a stack.** All KDE Frameworks at the same KF
+  version, all Plasma at the same Plasma version, etc. A 6.10 module beside a
+  6.28 module is forbidden (it breaks `find_package(... >= X)` and risks ABI skew).
+- **No "build-excluded until ported" packages.** If a package in a config does
+  not build on Redox, the fix is to *port it* (adapt the source, add the guard,
+  fix the recipe) — not to comment it out of the config. Commenting a package out
+  of a config to make the build pass is the same class of shortcut as a stub and
+  is equally forbidden.
+- **When the auto-rebase engine rejects a package** (its Redox shim/patch no
+  longer applies across upstream drift, or a mirror purged the old tarball), that
+  is a signal to **re-port by hand to the new version**, exactly as you would for
+  any upstream evolution — never to freeze it at the old version.
+
+A deferred old version or a commented-out package is technical debt that silently
+diverges the distro from itself; treat either as a build failure to be fixed, not
+a state to be shipped.
+
 ### Version conventions — two categories
 
 Red Bear OS has exactly two version categories: