Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

tasks/rewrite-vram-detection-python/SPEC.md

@@ -0,0 +1,32 @@
+# SPEC: Rewrite VRAM Detection as Python Script
+
+## Goal
+Replace the fragile `scripts/vram_detect.sh` with a testable Python script that produces the same JSON output.
+
+## Requirements
+1. Create `scripts/vram_detect.py` with the same CLI interface:
+   - `--model` / `-m`
+   - `--project` / `-p`
+   - Optional positional model name
+2. Preserve the human-readable output sections and the `=== JSON Output ===` block.
+3. Fix known bugs:
+   - Undefined `$headroom_pct` in manual mode.
+   - Hardcoded `"headroom": 0.25` in JSON output.
+   - GPU-counting/output ordering bug.
+   - Enforce 10KB file-read limit for API config files.
+4. Delete `scripts/vram_detect.sh`.
+5. Update references in `prompts/orchestrate.md`, `prompts/decompose.md`, `prompts/onboarding.md`, `README.md`, and `config.md` to point to the Python script.
+
+## Acceptance Criteria
+- [ ] `python scripts/vram_detect.py` runs and emits valid JSON.
+- [ ] Manual-mode headroom is read from `config.md`, not hardcoded.
+- [ ] Large API config files are read with a 10KB limit.
+- [ ] `scripts/vram_detect.sh` no longer exists.
+- [ ] All prompts/docs reference the Python script.
+
+## Non-Goals
+- Changing the recommendation algorithm.
+- Adding GPU vendor detection beyond Linux `nvidia-smi`, `lspci`, and `/proc/meminfo`.
+
+## Stop Condition
+When all acceptance criteria are met, output "CONTRACT_MET".