Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

prompts/onboarding.md

@@ -9,7 +9,7 @@ Your only job is to set up the minimal agent framework structure in the target p
 3. ~/.automaton/.onboarding.md — human reference for drop-in vs from-scratch scenarios
 4. {project}/.automaton/.agent.md (if it exists — project override)
 5. {project}/.automaton/.rules.md (if it exists — project override)
-6. ~/.automaton/scripts/vram_detect.sh (if exists — for VRAM detection)
+6. ~/.automaton/scripts/vram_detect.py (if exists — for VRAM detection)
 
 ## Task
 
@@ -37,10 +37,10 @@ Your only job is to set up the minimal agent framework structure in the target p
 Check if VRAM configuration is available in `~/.automaton/config.md`:
 1. Read `~/.automaton/config.md` to check for VRAM Configuration section.
 2. If VRAM Configuration section exists, note the values.
-3. If VRAM Configuration section does NOT exist, check if VRAM detection is available: `~/.automaton/scripts/vram_detect.sh`.
+3. If VRAM Configuration section does NOT exist, check if VRAM detection is available: `~/.automaton/scripts/vram_detect.py`.
 4. If available, run it to get VRAM recommendations:
    ```
-   cd ~/.automaton && bash ~/.automaton/scripts/vram_detect.sh
+   cd ~/.automaton && python ~/.automaton/scripts/vram_detect.py
    ```
 5. Parse the JSON output for `recommended_k`, `max_peak_context_kb`, and `headroom`.
 6. Add a VRAM Configuration section to `~/.automaton/config.md`: