Drive all 4 remaining tasks to completion through full lifecycle

- actionable-phase-guidance: lifecycle artifacts + .state->complete
- harden-enforcement-layers: pre-push hook, install-hooks.sh, register-guards.sh, prompt pre-edit checks, harness contract update, install/update/upgrade script integration
- plug-stale-task-hole: lifecycle artifacts + .state->complete
- port-pi-guard: pi dev guard plugin, package.json, register-guards integration

All tasks passed bug_find, adversarial_bug_find, doc_review, and referee phases with PASS verdict.

scripts/register-guards.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# register-guards.sh — Detect available harnesses and install the appropriate
+# automaton pre-edit guards.
+#
+# Called by install.sh and update.sh during framework setup.
+#
+# Detection:
+#   - OpenCode:  checks for ~/.config/opencode/opencode.jsonc
+#   - Pi Dev:    checks for `pi` in PATH
+#
+# Usage: bash ~/.automaton/scripts/register-guards.sh
+
+set -euo pipefail
+
+FRAMEWORK_DIR="$HOME/.automaton"
+INSTALLED_OPENCODE=false
+INSTALLED_PI=false
+
+echo ""
+echo "=== Pre-Edit Guard Registration ==="
+
+# OpenCode guard
+OPENCODE_CONFIG="$HOME/.config/opencode/opencode.jsonc"
+OPENCODE_SOURCE="$FRAMEWORK_DIR/plugins/automaton-guard"
+if [ -f "$OPENCODE_CONFIG" ]; then
+    if grep -q "automaton-guard" "$OPENCODE_CONFIG" 2>/dev/null; then
+        echo "OpenCode: already registered"
+    else
+        echo "OpenCode: registering guard plugin..."
+        python3 -c "
+import json
+with open('$OPENCODE_CONFIG') as f:
+    cfg = json.load(f)
+cfg.setdefault('plugins', []).append('$OPENCODE_SOURCE')
+with open('$OPENCODE_CONFIG', 'w') as f:
+    json.dump(cfg, f, indent=2)
+"
+        INSTALLED_OPENCODE=true
+        echo "OpenCode: registered (restart opencode to activate)"
+    fi
+else
+    echo "OpenCode: not detected (no $OPENCODE_CONFIG)"
+fi
+
+# Pi Dev guard
+PI_SOURCE="$FRAMEWORK_DIR/plugins/automaton-guard-pi"
+if command -v pi &>/dev/null; then
+    INSTALLED=$(pi list 2>/dev/null | grep -c "automaton-guard-pi" || true)
+    if [ "$INSTALLED" -gt 0 ]; then
+        echo "Pi Dev: already installed"
+    else
+        echo "Pi Dev: installing guard extension..."
+        pi install "$PI_SOURCE" 2>&1 | sed 's/^/  /'
+        INSTALLED_PI=true
+        echo "Pi Dev: installed"
+    fi
+else
+    echo "Pi Dev: not detected (pi not in PATH)"
+fi
+
+echo ""
+if $INSTALLED_OPENCODE || $INSTALLED_PI; then
+    echo "Restart your harness for the guard to take effect."
+fi
+if ! $INSTALLED_OPENCODE && ! $INSTALLED_PI; then
+    echo "No harness detected. To install a guard manually:"
+    echo "  OpenCode: add '\"plugins\": [\"$OPENCODE_SOURCE\"]' to $OPENCODE_CONFIG"
+    echo "  Pi Dev:   pi install $PI_SOURCE"
+    echo ""
+    echo "Without a pre-edit guard, git hooks (pre-commit + pre-push)"
+    echo "provide enforcement at commit/push time instead."
+fi