Archive completed tasks, add cleanup commands, self-documenting dashboard UI

- Archive 79 completed framework-dev tasks from tasks/ -> tasks/complete/
- status.py: add --cleanup-done and --install-cleanup-schedule commands
- Add scripts/automaton-cleanup.sh for periodic task archiving
- Dashboard: rename 'Background' tab -> 'Agent', 'Cleanup' agent -> 'Completed Task Archiver', remove redundant group headers and pill badges, dim inactive agent placeholders
- .rules.md: add Self-Documenting UI Names rule
- New tests: test_cleanup_done.py, expanded test_app.py and test_task.py

tasks/fix-dashboard-cors-origin/IMPLEMENTATION.md

@@ -1,18 +0,0 @@
-# Implementation: fix-dashboard-cors-origin
-
-## Bug
-Dashboard's `app.py` set `Access-Control-Allow-Origin: *` (wildcard CORS) on all responses via `CORS_HEADERS`. Since the dashboard is a local single-origin app, this wildcard CORS header is unnecessary and poses a security risk — any malicious webpage on the machine could make requests to the dashboard API.
-
-## Fix
-1. Removed `CORS_HEADERS` dictionary (which contained `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Methods`)
-2. Added `SECURITY_HEADERS` with `X-Content-Type-Options: nosniff` and `X-Frame-Options: DENY`
-3. Updated `_send_json()`, `_send_error()`, and `do_OPTIONS()` to use `SECURITY_HEADERS` instead of `CORS_HEADERS`
-4. `do_OPTIONS()` no longer returns `Access-Control-Allow-*` headers — it simply returns 204 No Content
-
-## Files Changed
-- `automaton/dashboard/ui/app.py`: Replaced `CORS_HEADERS` with `SECURITY_HEADERS`, updated all response methods
-- `tests/test_app.py`: Updated CORS-related tests to assert NO `Access-Control-Allow-Origin` header is present, and that security headers are sent
-
-## Tests
-- `test_app.py` tests updated to verify security headers (`X-Content-Type-Options`, `X-Frame-Options`) and absence of CORS headers
-- All 249 tests pass