Support checked-in .caos/agent.json repository instructions

[nishu-builder]

Independent PR based on main (replaces #161, which GitHub had locked into a managed stack; merges cleanly in any order with #159 and #165).

A repository can now steer the caos agent with a checked-in .caos/agent.json:

{"instructions": "Build with `nix build`. Run the `test` tool before finishing a change."}

Harness (std/llm-step): the file is reread from the current workspace on every round — the same freshness contract as the tool registry — and its instructions string is appended to the curried system prompt, so every turn (the publish preparation turn included) runs under the repository's own rules. Unknown fields are ignored so the schema can grow under harnesses already baked into worker images; a malformed file fails the round loudly rather than silently running without the repository's rules.

agent.json becomes the one .caos entry a workspace may carry at rest:

• conversation bases and /update-tree proposals accept it — both the client's reject_reserved_caos and llm-step's first-turn base guard now list .caos's entries and refuse anything else, naming the offenders;
• the publish-tip check allows it while still refusing a leftover .caos/conflicts (even an empty one);
• the inline read/write/edit tools treat it like any other file;
• a subagent's snapshot keeps it (and only it) when the parent's .caos harness state is stripped;
• the TUI workspace diff now excludes only .caos/conflicts, so an edit to the instructions shows up for review. The merge worker already preserves it (git archive of the merged tree).

With validation policy owned by the repository, the publication preparation request drops the generic "Build and test" — a repo that wants gates before a PR names them in its own instructions. The merge tool's post-conflict "build and test" hint is deliberately untouched: it serves conflict resolution generally, not pre-push policy.

Docs updated where the reserved-.caos rule is stated (SPEC.md — new "Repository agent instructions" section — design/chat.md, TUI.md).

Tests: new tests/agent-instructions suite in the current worker.sh/.caos-expr harness shape (cli-test base) drives a scripted turn end to end — a base carrying only .caos/agent.json is admitted, the stubbed request's system carries the instructions verbatim (appended, not replacing the curried prompt), the conversation head keeps the file, and a base with any other .caos entry is still refused before admission. Unit tests cover the JSON parsing, the system composition, the inline-tool path guard, and both client guards.

Note on rollout: this PR deliberately does not add a .caos/agent.json to the caos repo itself. A worker image only picks up the new harness after caosd reset (CLAUDE.md), so checking the file in before stacks are reset would make older deployed clients refuse the base tree. Adding caos's own instructions file is a natural follow-up once this lands and stacks are rebuilt.

---

Generated by Claude Code

[nishu-builder]

Full caos suite run (caos-cli run dev/run-tests on a stack built from these sources, on the merge of #168 + #165 + #166 over current main): 46/47 passed, including the new tests/agent-instructions end-to-end suite (base with only .caos/agent.json admitted; instructions delivered verbatim in the stubbed request's system prompt; any other .caos entry still refused). The one failure is tests/world-guard, which SPEC documents as expected when the suite runs against a host stack rather than inside the test container.

---

Generated by Claude Code