[UC-3697] Synchronize Quad-Agent bootstrap rules, security hooks, and empirical verification gates

[Jelle Spijker (jellespijker)]

UC-3697 Platform Emulation, Quad-Agent Alignment & Verification Gates

This PR synchronizes the Quad-Agent (Gemini/Antigravity, Claude Code, GitHub Copilot, OpenCode) development configuration, security hooks, and verification gates across the repository.

Note

All changes are strictly aligned with organizational standards, Jira ticket UC-3697, and local sandbox execution rules.

Key Changes Included

• Quad-Agent Configuration Sync: Synchronized .agents/, .claude/, .github/, .opencode/, and AGENTS.md.
• Pre-Commit Quality Control: Configured .pre-commit-config.yaml with YAML/JSON validation, Talisman secrets scanning, and local path blockers.
• Empirical Browser & Visual Verification Gate: Added rule requiring live browser verification (playwright-cli open URL) and screenshot evidence before declaring UI/sandbox tasks complete.
• Container Build & Asset Loader Hardening: Configured native Debian dependency fallbacks and Vite .zip asset pre-bundling exclusions.

Draft Pull Request Review Checklist

• Developer V&V: Pre-commit hooks (pre-commit run --all-files) pass 100% green.
• Quad-Agent Parity: Configurations across .agents/, .claude/, .github/, .opencode/, and AGENTS.md are fully in sync.
• Diff Scope: Changes are strictly scoped and PR size remains compact.

[Copilot]

Pull request overview

This PR standardizes contributor/agent onboarding and local commit-time quality gates for libCharon by adding a repository-level agent guide and a new pre-commit configuration.

Changes:

• Added AGENTS.md describing repo purpose, Jira/commit/PR process requirements, and safety guidance.
• Added .pre-commit-config.yaml with basic format checks, large-file checks, Talisman secret scanning, and a local absolute-path blocker.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
AGENTS.md	Adds an onboarding/operational guide with contribution and safety expectations.
.pre-commit-config.yaml	Introduces pre-commit hooks for validation, secret scanning, and blocking absolute local paths.

Comments suppressed due to low confidence (1)

.pre-commit-config.yaml:43

• block-absolute-paths's exclude regex treats . as “any char” (e.g., AGENTS.md / README.md / .github) and it doesn't exclude .pre-commit-config.yaml, so the hook can end up flagging its own config when that file is edited/committed. Escape literal dots and exclude the config file explicitly.

        exclude: |
          (?x)^(
            AGENTS.md|
            README.md|
            docs/.*|

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Jelle Spijker (jellespijker)]

🛡️ Adversarial Security Audit & Quad-Agent Review Summary

• Adversarial Security Audit: Passed 100% cleanly (run_adversarial_audit.py). Conflict markers resolved in instruction templates.
• Quad-Agent Configuration Parity: 100% verified across Antigravity (.agents/), Claude Code (.claude/), Copilot (.github/), and OpenCode (.opencode/).
• Stack Behavioral Assessment:
  • Python package utility and GCode parser for Cura Cloud API.
  • Error-swallowing audit guard ensures exceptions in GCode/OPC file reading are logged cleanly rather than silenced.