Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

prompts/decompose.md

@@ -4,11 +4,11 @@ Your only job is to take a completed SPEC.md and break it into the smallest poss
 
 ## Read These Files
 
-1. {project}/tasks/{task-name}/SPEC.md
+1. {project}/.automaton/tasks/{task-name}/SPEC.md
 2. {project}/.automaton/.rules.md (if exists — project override) OR ~/.automaton/.rules.md (global default) — project-specific rules
 3. ~/.automaton/config.md — Global framework configuration (VRAM, model settings)
 4. {project}/.automaton/.agent.md (if exists — project override) OR ~/.automaton/.agent.md (global default) — project agent config
-5. {project}/.automaton/scripts/vram_detect.sh (if exists — project override) OR ~/.automaton/scripts/vram_detect.sh (global default) — VRAM detection
+5. {project}/.automaton/scripts/vram_detect.py (if exists — project override) OR ~/.automaton/scripts/vram_detect.py (global default) — VRAM detection
 
 ## Task
 
@@ -98,7 +98,7 @@ Before decomposing, analyze the SPEC.md:
 6. Estimate the token budget for the full task (sum of all requirements' SPEC + DESIGN + TEST files)
 7. **Detect VRAM limits**:
    - Check `~/.automaton/config.md` for VRAM Configuration section
-   - If `Auto-detect: Yes`, run `{project}/.automaton/scripts/vram_detect.sh` to probe GPU VRAM, RAM, and model context window
+   - If `Auto-detect: Yes`, run `{project}/.automaton/scripts/vram_detect.py` to probe GPU VRAM, RAM, and model context window
    - If `Auto-detect: No`, use the manually specified values from config.md
    - Report the detected VRAM limits
 8. **Detect model context window**:
@@ -156,7 +156,7 @@ Only produce the DECOMPOSITION.md after the user says "APPROVED" or equivalent.
 
 ## Output
 
-Produce a file called DECOMPOSITION.md at {project}/tasks/{task-name}/DECOMPOSITION.md that contains:
+Produce a file called DECOMPOSITION.md at {project}/.automaton/tasks/{task-name}/DECOMPOSITION.md that contains:
 
 ```markdown
 # Task Decomposition