feat(tier2): create tier-2-auto-execute slash command template

conductor/tier2/commands/tier-2-auto-execute.md

@@ -0,0 +1,44 @@
+---
+description: Autonomously execute a conductor track in the Tier 2 sandbox
+agent: tier2-autonomous
+---
+
+# /tier-2-auto-execute
+
+Run a track autonomously in the Tier 2 sandboxed mode. No `permission: ask` prompts.
+
+## Arguments
+
+$ARGUMENTS - Track name (required). Examples: `result_migration_review_pass`, `data_structure_strengthening_20260606`.
+Optional flags: `--resume` (continue from last completed task), `--toast` (Windows toast on give-up).
+
+## Pre-flight
+
+1. **Verify sandbox is active.** This slash command must be invoked from a sandboxed OpenCode session. If `manual-slop_get_ui_performance` returns an error or the run_tier2_sandboxed.ps1 wrapper is not in the parent process, refuse to start.
+2. **Load the track spec.** Read `conductor/tracks/<track-name>/spec.md` and `plan.md` from the current branch. If the track does not exist, abort.
+3. **Check for a previous run.** If `<app-data>/tier2/<track-name>/state.json` exists AND `--resume` is NOT set, abort with: "Previous run found for this track. Use `--resume` to continue, or delete the state file to start fresh."
+
+## Protocol
+
+1. `git fetch origin main`
+2. `git switch -c tier2/<track-name> origin/main` (NOT `git checkout` - it is banned)
+3. Initialize failcount state at `<app-data>/tier2/<track-name>/state.json` (use `load_state` or fresh state)
+4. For each task in `plan.md`:
+   a. Red: delegate test creation to @tier3-worker
+   b. Run tests; if pass unexpectedly, call `record_red_failure` and check `should_give_up`
+   c. Green: delegate implementation to @tier3-worker
+   d. Run tests; if fail, call `record_green_failure` and check `should_give_up`
+   e. On green: `record_commit` and `record_green_success` (resets counters)
+   f. Commit per task with `git add . && git commit -m "..."` and attach git note
+   g. Update `plan.md` with commit SHA
+5. After all tasks complete, print success summary.
+6. On give-up: call `write_failure_report` from `scripts.tier2.write_report`, print "TRACK ABORTED, see report at <path>".
+
+## Hard Bans (enforced by 3 layers)
+
+- `git restore*` (any form) — denied
+- `git push*` (any push) — denied
+- `git checkout*` (any form) — denied; use `git switch` instead
+- `git reset*` (any form) — denied
+
+Filesystem access is restricted to the Tier 2 clone + `<app-data>/manual_slop/tier2/`. The Windows restricted token blocks reads/writes outside these paths at the OS level.