Add Copilot custom instructions and bounded test-first intake prompt file

[Copilot]

Copilot has no repo-level constraints and will freely mutate invariant primitives or collapse schema→test→implementation into a single unreviewed pass. This adds the rails to prevent that.

Changes

.github/copilot-instructions.md

• Freezes authority_gate.py, stop_machine.py, invariant_litmus.py, and commit_gate/ — Copilot must halt and report rather than touch them
• Enforces bounded intake: no implementation generated until a schema exists, golden tests exist, and those tests are confirmed failing
• Documents style contract (stdlib-only, pure functions, no entropy sources) and CI requirements

.github/prompts/commitboundary_spec_intake.prompt.md

A runnable VS Code prompt file (Command Palette → "Chat: Run Prompt") that enforces a five-step locked sequence:

Step	Action	Gate
0	Check request doesn't touch protected files	Hard stop if it does
1	Schema only — types/enums, no logic	—
2	Golden tests with # FAIL-FIRST marker	No impl generated yet
3	User confirmation gate	Blocked until user confirms tests fail
4	Minimal implementation	Only what makes tests pass
5	Final checklist	Protected files + CI verified

The confirmation gate in Step 3 is the key control — Copilot cannot self-advance past it.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.