conductor(tier-setup): MANDATORY pre-action reading + pre-commit abort on leak

ROOT CAUSE (post-mortem at docs/reports/TIER2_MCP_REGRESSION_20260624.md):
- Tier 1 asserted claims from old reports without re-verifying (SSDL campaign
  was designed from a static text string '6 nil-check functions' in
  src/code_path_audit_gen.py:108 that was never a runtime measurement)
- Tier 2 (autonomous) made an empty fix commit (2b7e2de1) for the MCP
  regression; the pre-commit hook silently stripped opencode.json +
  mcp_paths.toml and the agent reported success without verifying with
  'git show HEAD --stat'
- Both happened because neither tier read the critical files before acting

THE FIX (this commit):

1. .agents/agents/tier1-orchestrator.md: add MANDATORY pre-action reading
   list (6 files: AGENTS.md, conductor/workflow.md, current track spec/plan,
   the 3 code_styleguides). Reference the 2026-06-24 SSDL failures.

2. .agents/agents/tier2-tech-lead.md: add MANDATORY pre-action reading list
   (8 files: AGENTS.md, workflow.md, edit_workflow.md, the githooks
   forbidden-files.txt, the tier2_leak_prevention spec, the 3 styleguides)
   + the MANDATORY pre-commit verification gate (3 checks per commit).

3. .agents/agents/tier3-worker.md: add 4-file read list (AGENTS.md, task
   spec, relevant styleguide, the actual code being modified). Tier 3 doesn't
   need the full 8-file list — Tier 2's task spec is the contract.

4. .agents/agents/tier4-qa.md: same 4-file read list (analysis context).

5. conductor/tier2/agents/tier2-autonomous.md: add the 8-file MANDATORY
   pre-action reading list + the MANDATORY pre-commit verification gate.

6. conductor/tier2/commands/tier-2-auto-execute.md: add the 8-file list
   to the pre-flight section (step 0).

7. conductor/tier2/githooks/pre-commit: change behavior from 'silent strip
   + commit anyway' to 'strip + ABORT commit with diagnostic message'.
   The previous behavior led to empty commits (the 2026-06-24 regression).
   The agent MUST investigate the leak before retrying the commit.

ENFORCEMENT (all tiers):
- First commit of any track must include 'TIER-N READ <list> before <task>'
  in the commit message. The failcount contract treats an unacknowledged
  first commit as a red-phase failure (per the error_handling.md Rule #0
  precedent).

NOT IN THIS COMMIT (deferred to followup tracks per the post-mortem):
- Rule 4 (CI gate for required files via scripts/audit_branch_required_files.py)
- AGENTS.md addition of the canonical 'MANDATORY Pre-Action Reading' section
  (separate track to ensure the project-root rules reflect the same list)
- Cross-platform agent files (.opencode/, .claude/, .gemini/) — those are
  generated from the canonical .agents/agents/ files; this commit updates
  the canonical sources.

7 files modified, 109 insertions, 6 deletions.

.agents/agents/tier3-worker.md

@@ -29,3 +29,13 @@ Your goal is to implement specific code changes or tests based on the provided t
 You have access to tools for reading and writing files, codebase investigation, and web tools.
 You CAN execute PowerShell scripts or run shell commands via discovered_tool_run_powershell for verification and testing.
 Follow TDD and return success status or code changes. No pleasantries, no conversational filler.
+
+## MANDATORY: Pre-Action Required Reading (added 2026-06-24)
+
+Before ANY code change, the agent MUST read these 4 files:
+1. `AGENTS.md` (project root) — operating rules
+2. The task spec (provided by Tier 2) — the specific change to make
+3. The relevant `conductor/code_styleguides/*.md` (whichever applies: `error_handling.md` for `Result[T]` work, `data_oriented_design.md` for DOD, `type_aliases.md` for naming)
+4. The actual code being modified (use `py_get_definition` + `get_code_outline` BEFORE writing)
+
+**Enforcement:** Tier 3 workers do NOT need to read the full 8-file list (that's for Tier 1 + Tier 2). The 4 files above are sufficient for code implementation. Tier 2's task spec is the contract; Tier 3 executes it.