Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

tests/test_prompt_paths.py

@@ -0,0 +1,44 @@
+"""Regression test for task path conventions in prompts and templates."""
+
+import re
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parent.parent
+PROMPTS_DIR = ROOT / "prompts"
+TEMPLATES_DIR = ROOT / "templates"
+
+# Legacy path pattern that should no longer appear.
+LEGACY_PATH = re.compile(r"\{project\}/tasks/\{task-name\}/")
+# Canonical path pattern that should be used instead.
+CANONICAL_PATH = re.compile(r"\{project\}/\.automaton/tasks/\{task-name\}/")
+
+
+def _markdown_files(*directories: Path) -> list[Path]:
+    files = []
+    for directory in directories:
+        if directory.exists():
+            files.extend(directory.rglob("*.md"))
+    return files
+
+
+@pytest.mark.parametrize("path", _markdown_files(PROMPTS_DIR, TEMPLATES_DIR))
+def test_no_legacy_task_paths(path: Path) -> None:
+    """Every prompt/template must use the canonical .automaton/tasks path."""
+    text = path.read_text(encoding="utf-8")
+    legacy_matches = LEGACY_PATH.findall(text)
+    assert not legacy_matches, (
+        f"Found legacy task path in {path.relative_to(ROOT)}: {legacy_matches}\n"
+        "Use {project}/.automaton/tasks/{task-name}/ instead."
+    )
+
+
+def test_canonical_path_present_in_prompts() -> None:
+    """At least one prompt uses the canonical path (sanity check)."""
+    found = False
+    for path in _markdown_files(PROMPTS_DIR):
+        if CANONICAL_PATH.search(path.read_text(encoding="utf-8")):
+            found = True
+            break
+    assert found, "No prompt uses the canonical {project}/.automaton/tasks/{task-name}/ path"