Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

.rules.md

@@ -29,3 +29,8 @@
 - Never scan, read, or modify tasks in other projects on the system
 - The `{project}` in the Orchestrator prompt is the project root where the session started — do not broaden scope
 - Past failure: agent scanned tasks in `~/ai-env/projects/invest-copilot/` while working on the automaton framework itself, wasting time on unrelated work across project boundaries
+
+## Artifact Integrity
+- Write task artifacts atomically to avoid partial reads by the dashboard or other agents
+- Prefer writing to a temporary file and renaming it into place
+- Avoid leaving empty or malformed artifacts in the task folder