docs: document CI pipeline for agent PRs (#562)

CI pipeline already implemented in .gitea/workflows/agent-pr-gate.yml.
This PR documents the existing implementation:
- Risk classification (low/medium/high)
- Syntax check (YAML, JSON, Python, Bash)
- Test suite (pytest)
- Criteria verification
- Auto-merge for low-risk clean PRs
- PR comment with failure details

docs/ci-pipeline.md

@@ -0,0 +1,34 @@
+# CI Pipeline for Agent PRs
+
+Implements #562: [FLEET-009] Build CI Pipeline for Agent PRs.
+
+## Overview
+
+The agent PR gate (`.gitea/workflows/agent-pr-gate.yml`) automatically validates agent-created PRs before merge.
+
+## Pipeline Steps
+
+1. **Risk Classification** — Classifies PR risk (low/medium/high) based on files changed
+2. **Syntax Check** — Validates YAML, JSON, Python, and Bash syntax
+3. **Test Suite** — Runs pytest
+4. **Criteria Verification** — Validates PR against acceptance criteria
+5. **Report** — Posts results as PR comment
+6. **Auto-Merge** — Merges low-risk PRs automatically if all checks pass
+
+## Risk Levels
+
+- **Low**: Safe files only (docs, tests, non-critical scripts). Auto-merges on pass.
+- **Medium**: Config or infrastructure changes. Requires human review.
+- **High**: Core system files (SOUL.md, deploy scripts, security code). Always requires human.
+
+## Failure Handling
+
+If any check fails:
+- Gate job fails (PR blocked from merge)
+- Report job posts comment with failure details
+- Author sees exactly what failed and why
+
+## Related
+
+- Auto-merge script: `scripts/auto_merge.sh` (excludes the-door per #183)
+- PR safety labeler: `scripts/pr-safety-labeler.sh` (labels crisis-critical repos)