chore: bring repo into compliance with AGENTS.md

[metyatech]

Brings the repository into compliance with the latest AGENTS.md rules.

Changes:

• Refreshed AGENTS.md via compose-agentsmd.
• Introduced task-tracker (.tasks.jsonl).
• Removed simple-git-hooks and unified pre-commit checks using husky.
• Added task-tracker check to the pre-commit hook.
• Addressed 3 moderate/high vulnerabilities via npm audit fix.

Verified with npm run verify (312 tests passed).

[metyatech]

Agent runner idle completed.

Repo: metyatech/agent-runner
Engine: gemini-flash
Notify: @metyatech

Summary:
(missing)

[Copilot]

Pull request overview

This PR updates repository tooling and policy artifacts to align with the latest AGENTS.md rules, including switching git hook management and refreshing dependency security fixes.

Changes:

• Removed simple-git-hooks configuration and standardized on Husky for pre-commit checks.
• Updated AGENTS.md content and introduced the committed task tracker state file (.tasks.jsonl).
• Applied npm audit fix-driven dependency updates in package-lock.json.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
package.json	Removes simple-git-hooks and keeps Husky as the hook manager (via prepare).
package-lock.json	Updates lockfile to reflect dependency/vulnerability fixes and removal of simple-git-hooks.
AGENTS.md	Refreshes composed rules and adds new sections; includes a couple of corrupted characters to fix.
.tasks.jsonl	Adds initial task-tracker state entry committed to the repo.
.husky/pre-commit	Consolidates pre-commit actions into a single line (currently breaks failure behavior and likely execution).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

There are stray/non-ASCII characters in the PowerShell safety bullets ("ↁEUse") which appear to be an encoding/glitch and make the instructions hard to read/search. Replace "ↁEUse" with the intended text (e.g., "→ Use:") on both bullets.

Suggested change

	- `Remove-Item` (aliases: `rm`, `ri`, `del`, `erase`) ↁEUse: `if ([IO.File]::Exists($p)) { [IO.File]::SetAttributes($p,[IO.FileAttributes]::Normal); [IO.File]::Delete($p) }`
	- `Remove-Item -Recurse` (aliases: `rmdir`, `rd`) ↁEUse: `if ([IO.Directory]::Exists($d)) { [IO.File]::SetAttributes($d,[IO.FileAttributes]::Normal); foreach ($e in [IO.Directory]::EnumerateFileSystemEntries($d,'*',[IO.SearchOption]::AllDirectories)) { [IO.File]::SetAttributes($e,[IO.FileAttributes]::Normal) }; [IO.Directory]::Delete($d,$true) }`
	- `Remove-Item` (aliases: `rm`, `ri`, `del`, `erase`) → Use: `if ([IO.File]::Exists($p)) { [IO.File]::SetAttributes($p,[IO.FileAttributes]::Normal); [IO.File]::Delete($p) }`
	- `Remove-Item -Recurse` (aliases: `rmdir`, `rd`) → Use: `if ([IO.Directory]::Exists($d)) { [IO.File]::SetAttributes($d,[IO.FileAttributes]::Normal); foreach ($e in [IO.Directory]::EnumerateFileSystemEntries($d,'*',[IO.SearchOption]::AllDirectories)) { [IO.File]::SetAttributes($e,[IO.FileAttributes]::Normal) }; [IO.Directory]::Delete($d,$true) }`

[Copilot]

task-tracker check is invoked directly in the pre-commit hook, but @metyatech/task-tracker is not a dependency in package.json/package-lock. On a clean machine this hook will fail unless the developer has a global install, which contradicts the repo rule that lifecycle hooks must succeed without global tool assumptions. Consider adding task-tracker as a devDependency and invoking it via the package manager executor (e.g., npm exec) so the hook is self-contained.

Suggested change

	task-tracker check; npm run verify; compose-agentsmd --compose || true; git add AGENTS.md || true
	npx task-tracker check; npm run verify; compose-agentsmd --compose || true; git add AGENTS.md || true

[Copilot]

The Husky pre-commit hook is now a single command line without a shebang or Husky bootstrap, and it chains commands with ;. This can (a) fail to execute on Unix with an “exec format error” and (b) allow commits to succeed even when task-tracker check or npm run verify fails, because ; does not propagate failures and the hook exit code becomes the last command’s status. Convert this back to a normal Husky hook script (with the expected header) and ensure failures from task-tracker check and npm run verify stop the commit (e.g., via set -e or && chaining), while keeping the optional compose-agentsmd/git add behavior if desired.