Document one-pipeline source and provenance in AGENTS.md

[p-datadog]

What does this PR do?

Adds a "One-Pipeline (GitLab CI)" section to AGENTS.md documenting what the
one-pipeline template is, where its source lives, and how it gets distributed
to consuming repos.

Motivation:

Investigating a CI failure in #5486 ("chore(ci) update one-pipeline") took
a long time because there was no documentation explaining where one-pipeline
comes from or how it works. The package-oci jobs were failing with a
misleading error ("42M is greater than 160MB limit") that turned out to be a
local 40MB override in .gitlab-ci.yml — the template hardcodes the default
limit in its error message instead of using the actual variable value.

This section captures the provenance chain so future investigators can go
straight to the source.

Provenance proof (how we know DataDog/libdatadog-build is the source):

1. .gitlab/one-pipeline.locked.yml includes a remote URL at
   gitlab-templates.ddbuild.io/libdatadog/one-pipeline/ca/<hash>/one-pipeline.yml.
2. DataDog/libdatadog-build contains templates/one-pipeline.yml — the
   source template with identical structure and content.
3. libdatadog-build/campaigner-config.yml lists dd-trace-rb as a consuming
   repo, with PR title "chore(ci) update one-pipeline" and branch name
   "campaigner/update-one-pipeline" — matching exactly how these PRs appear.
4. libdatadog-build/generate_prs.sh fetches the content-addressed template
   URL from GitLab CI project 2821's publish-content-addressable-templates
   job artifacts, then uses the campaigner tool to open PRs updating the
   locked URL in each consuming repo.

Change log entry

None.

Additional Notes:

None.

How to test the change?

Read the new section in AGENTS.md and confirm it matches the provenance
chain described above.

[datadog-datadog-prod-us1-2]

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 95.14% (-0.01%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: d0e7640 | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}