Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

prompts/research.md

@@ -80,7 +80,7 @@ Only produce the SPEC.md after the user says "APPROVED" or equivalent.
 
 ## Output
 
-Produce a file called SPEC.md at {project}/tasks/{task-name}/SPEC.md that contains:
+Produce a file called SPEC.md at {project}/.automaton/tasks/{task-name}/SPEC.md that contains:
 
 - Clear goal
 - Exact requirements (numbered)