Function generate_agent_rules 

pub fn generate_agent_rules(
    directory: &str,
    root: &str,
    clients: &[String],
) -> Result<AgentRulesResult, String>

generate_agent_rules(directory, root, clients) — write/update the managed block in each target under root. Writes are skipped when the embedded digest already matches (idempotent). An io error surfaces as Err for the caller’s cannot write under {root} usage error.