feat: Harden execute agent prompt with industry best practices

- Add Conventional Commits format requirement to git workflow
- Add pre-commit hook guidance (never --no-verify)
- Add secrets/credentials guard (never stage .env, API keys)
- Strengthen git add reasoning (explain why not git add .)
- Add CLAUDE.md read step to session startup
- Add lint/type-check gate to verification step
- Add doc update step to execution protocol
- Expand Definition of Done: lint, types, docs, debug cleanup
- Add anti-patterns: debug artifacts, spinning on failures (3x retry cap)
- Add stale reference check on file renames/moves
- Improve error signal guidance (include stack traces, not summaries)

apps/server/agent/prompts/shared.ts

@@ -9,7 +9,7 @@ export const SIGNAL_FORMAT = `
 As your final action, write \`.cw/output/signal.json\`:
 - Done: \`{ "status": "done" }\`
 - Need clarification: \`{ "status": "questions", "questions": [{ "id": "q1", "question": "..." }] }\`
-- Unrecoverable error: \`{ "status": "error", "error": "..." }\`
+- Unrecoverable error: \`{ "status": "error", "error": "..." }\` — include the actual error output, stack trace, or repro steps, not just a summary
 </signal_format>`;
 
 export const INPUT_FILES = `
@@ -60,9 +60,12 @@ export const GIT_WORKFLOW = `
 <git_workflow>
 You are in an isolated git worktree. Other agents work in parallel on separate branches.
 
-- Stage specific files with \`git add <file>\`, not \`git add .\`
+- Stage specific files with \`git add <file>\`, never \`git add .\` or \`git add -A\` — these risk staging secrets, build artifacts, or generated files
 - Never force-push
 - Run \`git status\` before committing
+- Commit messages use Conventional Commits: \`feat:\`, \`fix:\`, \`refactor:\`, \`docs:\`, \`test:\`, \`chore:\`. Describe the "why", not the "what".
+- If pre-commit hooks fail, fix the underlying issue — never bypass with \`--no-verify\`
+- Never stage secrets, \`.env\` files, credentials, or API keys. If you encounter them, \`git reset\` them immediately.
 </git_workflow>`;
 
 export const CODEBASE_EXPLORATION = `
@@ -102,8 +105,9 @@ export const SESSION_STARTUP = `
 <session_startup>
 1. \`pwd\` — confirm working directory
 2. \`git status\` — check for unexpected state
-3. Run test suite — establish green baseline. If already failing, signal "error". Don't build on a broken foundation.
-4. Read \`.cw/input/manifest.json\` and all **assignment** files (the \`files\` array). Do not bulk-read context files.
+3. Read \`CLAUDE.md\` at the repo root (if it exists) — it contains project conventions and patterns you must follow.
+4. Run test suite — establish green baseline. If already failing, signal "error". Don't build on a broken foundation.
+5. Read \`.cw/input/manifest.json\` and all **assignment** files (the \`files\` array). Do not bulk-read context files.
 </session_startup>`;
 
 export const PROGRESS_TRACKING = `