Align agents on persistent project scope

[Aaronontheweb]

Summary

• distinguish exact per-call path scope from persistent project scope in always-loaded guidance and the operations skill
• teach parent agents and tool-capable subagents to declare a different user-named project before repeated shell work
• keep Public and tool-filtered subagents free of unusable guidance
• add a sanitized behavioral eval that proves declaration precedes the two exact requested shell calls without telling the model which declaration tool to use
• retain eval child logs from both supported container log roots

Policy boundary

• no approval authority is widened
• one-shot WorkingDirectory remains exact call scope and does not create a safe root
• headless execution remains strict without explicit authority
• no executable-specific command parsing is added

Validation

• adversarial review: PASS, no warnings
• targeted behavioral eval: 4/5 at the configured threshold; the failed run used one-shot scope without project declaration and failed as intended
• Release build: 0 warnings, 0 errors
• full .NET test command: passed
• focused actor and prompt-provider suites: passed
• strict OpenSpec, headers, Bash syntax, portability, diff, and PII checks: passed
• Slopwatch: only the pre-existing SW004 in untouched PowerShellHostProbeTests.cs

The repository-wide behavioral suite was started from a fresh image, then stopped at maintainer direction after it entered unrelated MCP, memory, skill-routing, and background-job cases. Those failures are not changed or claimed fixed by this PR.