Restore archived tasks, fix dashboard scroll-reset, bind ornith, add Playwright smoke test

- **Restore 82 completed tasks** from tasks/complete/ back to tasks/ top
  level (all <7 days old per the cleanup policy; premature bulk archive
  was fixed).
- **Dashboard: fix scroll-reset on auto-refresh** — renderBoard rebuilds
  the board via innerHTML every 2s, destroying each column-body's
  scrollTop. Now snapshots column-body scrollTop + board.scrollLeft +
  view.scrollTop before rebuild and restores after (matched by
  PHASE_GROUPS index).
- **Dashboard UI additions** (pre-existing unstaged work): approval
  section cards, transition buttons, inline artifact editor (textarea for
  writing missing SPEC/VERDICT/etc from the detail modal).
- **Bind ornith as Implement model** — config.md: Model explicit to
  omlx/Ornith-1.0-35B-4bit-mlx, context window 32768. Interactive
  autopilot already used ornith via opencode default; now explicit.
- **Fix cleanup stub** — automaton-cleanup.sh had a stale --project arg
  pointing at a pytest temp dir (test isolation leak). Rewired to point
  at ~/.automaton.
- **Fix plist-isolation test** — test asserted host plist doesn't exist,
  but a real install creates it. Now snapshots mtime before run, asserts
  unchanged after (only a write during the test counts as bleed).
- **New Playwright smoke test** (tests/test_dashboard_ui.py) — 2 tests:
  board renders tasks, column scroll survives auto-refresh tick.
  Verified the test fails without the scroll fix (scrollTop resets to 0).
  Skipped via importorskip when playwright is absent (main CI stays
  green).
- **Clarify SI loop scope in README** — new-project onboarding section
  documents the framework-scoped self-improvement loop and options
  (leave/pause/create project loop).
- **CHANGELOG** documents all changes including the known model-divergence
  gap (mde tasks marked complete but per-role model binding was never
  implemented).

tasks/pre-existing-fixes/SPEC.md

@@ -0,0 +1,44 @@
+# Pre-existing Fixes
+
+## Goal
+Fix 4 pre-existing issues in the enforcement layer.
+
+## Issues
+
+### 1. `_infer_state_from_artifacts` heuristic bug
+**File**: `scripts/status.py` lines 306-309
+**Problem**: `if "SPEC.md" in artifacts and "BUG_REPORT.md" not in artifacts: return "bug_find"` — this is wrong. Having SPEC.md without BUG_REPORT.md could mean the task is in research, design, implement, etc. This condition is reached after line 304 checks for both SPEC+BUG_REPORT → adversarial_bug_find, so it only fires when BUG_REPORT.md is missing. But that's most tasks! The correct behavior is that SPEC.md alone should map to `research` (which line 318-319 already does).
+**Fix**: Remove lines 306-309 (the SPEC+no BUG_REPORT case). Also fix line 311 `IMPLEMENTATION.md` → `bug_find` — semantically, having only IMPLEMENTATION.md should map to `implement` completion, not `bug_find`. But since bug_find comes after implement, mapping to implement is wrong too. The safest fix: remove lines 308-311 so SPEC.md alone → research, IMPLEMENTATION alone → implement.
+
+### 2. `cmd_validate_folder` unnecessary fallback after `.state` exists
+**File**: `scripts/status.py` lines 563-566
+**Problem**: After confirming `.state` exists (line 548-556 handles the no-state case), lines 563-566 fall back to `_infer_state_from_artifacts` if `_read_state` returns None. But if `.state` exists and `_read_state` returns None, that's a corrupted `.state` file — not something to silently paper over.
+**Fix**: After confirming `.state` exists, if `_read_state` returns None, error out instead of falling back to inference.
+
+### 3. `upgrade.sh` silently swallows `status.py --upgrade` failures
+**File**: `scripts/upgrade.sh` line 26
+**Problem**: `python3 "$STATUS_SCRIPT" --upgrade --project "$PROJECT_DIR" || true` — the `|| true` means failures are silently swallowed. With `set -euo pipefail`, this is even more dangerous because the script appears to succeed.
+**Fix**: Remove `|| true`. If the upgrade fails, the script should fail. Add a clear error message.
+
+### 4. `upgrade.sh` doesn't verify python3 is available
+**File**: `scripts/upgrade.sh`
+**Problem**: The script runs `python3` without checking it's installed.
+**Fix**: Add a python3 availability check at the top of the script.
+
+### 5. Pre-commit hook doesn't handle bare repos or worktrees
+**File**: `scripts/upgrade.sh` lines 60-62, `scripts/git-hooks/pre-commit` line 18
+**Problem**: `upgrade.sh` checks for `.git/hooks/` directory, and the pre-commit hook uses `git rev-parse --show-toplevel`. In bare repos, `.git/` doesn't exist as a directory. In worktrees, `.git` is a file, not a directory.
+**Fix**:
+- `upgrade.sh`: Use `git rev-parse --git-dir` to find the hooks directory instead of assuming `.git/hooks/`
+- `pre-commit`: Already uses `git rev-parse --show-toplevel` which works for worktrees. No change needed there.
+- `upgrade.sh`: Use `git rev-parse --git-dir` to reliably find hooks dir
+
+## Acceptance Criteria
+- [ ] `_infer_state_from_artifacts` no longer returns `bug_find` for SPEC-only tasks
+- [ ] `_infer_state_from_artifacts` no longer returns `bug_find` for IMPLEMENTATION-only tasks
+- [ ] `cmd_validate_folder` errors on corrupted `.state` files instead of falling back
+- [ ] `upgrade.sh` fails loudly when `status.py --upgrade` fails
+- [ ] `upgrade.sh` checks python3 is available before proceeding
+- [ ] `upgrade.sh` uses `git rev-parse --git-dir` for hooks directory
+- [ ] All 200+ existing tests pass
+- [ ] New tests for each fix