Harden framework: tests, VRAM Python, dashboard spec, security, CI

- Rewrite vram_detect in Python with fixed config parsing and 10KB read limit

- Add pytest suite (72 tests) covering dashboard core, app security, and VRAM

- Standardize all prompts to .automaton/tasks/{task-name}/ path

- Reconcile dashboard spec with web implementation; remove themes.py

- Remove half-implemented refresh.py file watcher

- Harden dashboard static-file serving and task-name validation

- Add uncommitted-change guard to update.sh and real Gitea URLs

- Add AGENTS.md, Gitea CI workflow, and template documentation

tests/test_scope.py

@@ -0,0 +1,62 @@
+"""Tests for automaton.dashboard.core.scope."""
+
+from pathlib import Path
+
+import pytest
+
+from automaton.dashboard.core.scope import detect_scope, find_automaton_root
+
+
+@pytest.fixture
+def temp_project(tmp_path: Path) -> Path:
+    """Create a temporary automaton project."""
+    (tmp_path / ".automaton").mkdir()
+    return tmp_path
+
+
+@pytest.fixture
+def nested_project(tmp_path: Path) -> Path:
+    """Create a nested automaton project."""
+    project = tmp_path / "my-project"
+    (project / ".automaton").mkdir(parents=True)
+    return project
+
+
+def test_find_automaton_root_in_project(temp_project: Path) -> None:
+    root = find_automaton_root(temp_project)
+    assert root == temp_project
+
+
+def test_find_automaton_root_from_subdir(temp_project: Path) -> None:
+    subdir = temp_project / "src" / "deep"
+    subdir.mkdir(parents=True)
+    root = find_automaton_root(subdir)
+    assert root == temp_project
+
+
+def test_find_automaton_root_not_found(tmp_path: Path) -> None:
+    root = find_automaton_root(tmp_path)
+    assert root is None
+
+
+def test_detect_scope_project(temp_project: Path) -> None:
+    root, scope = detect_scope(temp_project)
+    assert root == temp_project
+    assert scope == "project"
+
+
+def test_detect_scope_framework(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """Framework mode is detected when .automaton is directly in home."""
+    fake_home = tmp_path / "home"
+    fake_home.mkdir(parents=True)
+    (fake_home / ".automaton").mkdir()
+    monkeypatch.setattr(Path, "home", lambda: fake_home)
+    root, scope = detect_scope(fake_home)
+    assert root == fake_home
+    assert scope == "framework"
+
+
+def test_detect_scope_none(tmp_path: Path) -> None:
+    root, scope = detect_scope(tmp_path)
+    assert root is None
+    assert scope == "none"