[UC-3697] Establish Quad-Agent development architecture, pre-commit tooling, and Emscripten safety

[Jelle Spijker (jellespijker)]

Stacked PR (Layer 2 of Stack #9) establishing Quad-Agent development architecture and pre-commit tooling.
Base layer: #8 (UC-3697-cpp-fixes-and-formatting).

Why

Establish a unified Quad-Agent collaborative development environment (Gemini/Antigravity, Claude Code, GitHub Copilot, OpenCode) for CuraFormulaeEngine, integrate automated quality control pre-commit hooks, and protect secrets and local paths.

What

• Quad-Agent Configuration Alignment: Canonical .agents/ configuration synchronized with .claude/, .github/, and .opencode/ via scripts/sync_agentic_configs.sh.
• Pre-Commit Quality & Security Gates: Configured .pre-commit-config.yaml with clang-format, Talisman secret scanning, local path blockers, rule frontmatter validators, file size ratchets, and complexity checks.
• CI / GitHub Workflows: Updated .github/workflows/unit-test.yml and .github/workflows/package.yml to trigger on UC-* / NP-* branches.
• Stacked PR Separation: Extracted foundational C++ code fixes, formatting, and CTest integration onto boy-scouting PR [UC-3697] Format C++ codebase and fix formula evaluation and parsing #8.

How

1. Single Source of Truth: Rules and agent definitions live canonically in .agents/rules/ and .agents/agents/. Symlinks and generated rule manifests ensure 100% parity across Claude Code, Copilot, and OpenCode.
2. Context Exclusion: Central .aiignore compiled into platform-specific exclude configurations (.ignore, .claude/settings.json, .github/copilot-content-exclusion.yml, opencode.json).
3. Stacked Architecture: Stacked cleanly on top of [UC-3697] Format C++ codebase and fix formula evaluation and parsing #8.

Verification & Validation (V&V)

1. Parity Audit

python3 .agents/hooks/audit_quad_agent_parity.py
# ==> Parity audit PASSED across Antigravity, Claude Code, Copilot, and OpenCode

2. Guard Fire-Proofing Table

Hook	Fired	Blocked Violation	Status
audit-quad-agent-parity	Yes	n/a (advisory)	Passed
block-absolute-paths	Yes	Yes (fixture blocked)	Passed
block-name-matched-kill	Yes	Yes (pkill fixture blocked)	Passed
block-secrets	Yes	Yes (staged secret blocked)	Passed
check-rule-frontmatter	Yes	n/a (advisory)	Passed
check-upstream-alignment	Yes	n/a (advisory)	Passed
pretool-guard	Yes	Yes (secret/path payload blocked)	Passed

3. Pre-Commit Hook Suite

pre-commit run --all-files
# ==> 19 / 19 hooks passed cleanly

4. Catch2 Unit Tests

ctest --preset conan-release --output-on-failure
# ==> 158 / 158 tests passed (100%)

---

PR Checklist

• Describe the changes that were made and why
• Unit tests verified locally
• Initiating developer reviewed AI-generated code

[Copilot]

Pull request overview

Adds a repository-wide pre-commit configuration to run basic hygiene checks, Talisman secret scanning, and a local “absolute path” blocker to prevent committing environment-specific paths.

Changes:

• Introduces .pre-commit-config.yaml with pre-commit-hooks checks (YAML/JSON validation, whitespace, EOF, large files).
• Adds Talisman talisman-commit hook for secret scanning with an exclusion list.
• Adds a local pygrep hook to block absolute home-directory path references.

Comments suppressed due to low confidence (1)

.pre-commit-config.yaml:42

• In this exclude regex, AGENTS.md / README.md use . which matches any character in regex. If you mean the literal filenames, escape the dots to avoid unintentionally excluding similarly-named files.

            AGENTS.md|
            README.md|

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Jelle Spijker (jellespijker)]

🛡️ Adversarial Security Audit & Quad-Agent Review Summary

• Adversarial Security Audit: Passed 100% cleanly (run_adversarial_audit.py). All leftover conflict markers resolved, no hardcoded local paths or secret leaks detected.
• Quad-Agent Configuration Parity: 100% verified across Antigravity (.agents/), Claude Code (.claude/), Copilot (.github/), and OpenCode (.opencode/).
• Stack Behavioral Assessment:
  • C++20 mathematical expression parser & AST evaluation engine.
  • Pre-tool guards block absolute path leaks (/home/username), secret credentials, and forbidden branch commits.
  • Post-edit linter automatically enforces clang-format rules on AST & grammar header changes.