docs(agents): document <PROJECT> vs <project>, and catch spaced variants

[potiuk]

Summary

• <PROJECT> (display name, 84 uses) and <project> (infrastructure slug, 313 uses) are both load-bearing — across skills, tool docs, organizations/ASF/organization.md and PRINCIPLES.md — yet neither had a row in the placeholder table in AGENTS.md, which closes with "do not invent new placeholders". Answering "is <project> an invented placeholder?" needed a repo-wide grep instead of a table lookup. Both now have a row, plus a note stating the difference explicitly: two placeholders holding two different values, not one value in two casings. Substituting one where the other belongs produces something wrong rather than mis-cased — Apache Foo.apache.org is not a hostname.
• The same case-only difference is a linter hazard. FORBIDDEN_PATTERNS is matched with grep -F, so the name:"airflow" entry added in fix(skills): derive the two remaining Airflow literals from project config #1144 only caught the no-space spelling — GraphQL, YAML and JSON all accept name: "airflow" equally, and that form passed every pattern in the list. Patterns whose surrounding syntax admits optional whitespace now live in a new FORBIDDEN_REGEXES array matched with grep -E; the two arrays share one match-reporting path. Fixed strings stay the default — easier to read, and they cannot misfire on regex metacharacters.

Both gaps surfaced while reviewing #1144; this is the follow-up that PR's review nit pointed at.

Type of change

• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• CI / dev loop (prek, workflows, validators)

Test plan

• prek run passes on both changed files — including lychee (the new link to tools/dev/check-placeholders.sh resolves) and doctoc (no headings changed, so the TOC is untouched).
• Linter is clean on the current tree: tools/dev/check-placeholders.sh exits 0.
• Regression, new behaviour: planting repository(owner: "apache", name: "airflow") in skills/ is now caught — it was not caught before this change.
• Regression, existing behaviour: planting repository(owner:"apache",name:"airflow") is still caught, so the grep -F → grep -E move loses no coverage.
• bash -n tools/dev/check-placeholders.sh clean.
• No eval suites affected — no SKILL.md or step prompt material changes, so per AGENTS.md § When the rule fires this is the prose/tooling row that needs no fixture rerun.

RFC-AI-0004 compliance

• Vendor neutrality — this PR strengthens the mechanical gate that enforces placeholder discipline, and documents the two placeholders it protects.

Linked issues

Follow-up to #1144.