Drive all 4 remaining tasks to completion through full lifecycle

- actionable-phase-guidance: lifecycle artifacts + .state->complete
- harden-enforcement-layers: pre-push hook, install-hooks.sh, register-guards.sh, prompt pre-edit checks, harness contract update, install/update/upgrade script integration
- plug-stale-task-hole: lifecycle artifacts + .state->complete
- port-pi-guard: pi dev guard plugin, package.json, register-guards integration

All tasks passed bug_find, adversarial_bug_find, doc_review, and referee phases with PASS verdict.

plugins/README.md

@@ -0,0 +1,40 @@
+# Automaton Guard Plugin
+
+**Harness**: OpenCode (`@opencode-ai/plugin`)
+**Status**: Active
+**Enforcement**: Pre-edit (`tool.execute.before`)
+
+Blocks file modifications (`edit`, `write` tools) when no automaton task is in
+implement or doc_review phase. Calls `status.py --can-edit --file <path> --json`
+before every edit.
+
+## Installation
+
+The framework install/update scripts auto-register this plugin in
+`~/.config/opencode/opencode.jsonc`:
+
+```json
+{
+  "plugins": ["~/.automaton/plugins/automaton-guard"]
+}
+```
+
+## Other Harnesses
+
+| Harness | Plugin | Status |
+|---------|--------|--------|
+| OpenCode | `plugins/automaton-guard/plugin.ts` | ✅ Active |
+| Pi Dev | `plugins/automaton-guard-pi/guard.ts` | ✅ Active |
+| Other | N/A | N/A |
+
+To add support for a new harness, create a plugin in `plugins/` that calls
+`status.py --can-edit --file <path>` before tool execution, matching the
+`contracts/harness-integration.md` specification.
+
+## Enforcement Layers
+
+| Layer | Mechanism | Harness scope |
+|-------|-----------|---------------|
+| Pre-edit | This plugin | OpenCode only |
+| Pre-commit | `scripts/git-hooks/pre-commit` | All git projects |
+| Pre-push | `scripts/git-hooks/pre-push` | All git projects |