Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

tasks/remove-file-system-watcher/SPEC.md

@@ -0,0 +1,20 @@
+# SPEC: Remove File System Watcher
+
+## Goal
+Resolve the half-implemented `refresh.py` module by removing it and documenting the polling-based refresh behavior.
+
+## Requirements
+1. Delete `automaton/dashboard/core/refresh.py`.
+2. Update `automaton/dashboard/README.md` to state that auto-refresh uses client-side polling.
+3. Ensure no imports or references to `refresh.py` remain.
+
+## Acceptance Criteria
+- [ ] `automaton/dashboard/core/refresh.py` does not exist.
+- [ ] `README.md` accurately describes the polling refresh mechanism.
+- [ ] `python -m automaton.dashboard` still starts and refreshes correctly.
+
+## Non-Goals
+- Implementing Server-Sent Events or WebSocket push.
+
+## Stop Condition
+When all acceptance criteria are met, output "CONTRACT_MET".