enhance-agent-guardrails — Guardrails-as-Code Against AI Regressions

AI agents ship the visible 80% fast and skip the 20% that keeps a repo safe. Studies in 2026 put ~45% of AI-generated code shipping OWASP Top-10 issues, ~2.74× more security findings per PR, and repeated production disasters from unguarded destructive actions. Telling the agent to "be secure" doesn't work — deterministic gates do. This skill installs those gates so the next fast session can't quietly reintroduce old classes of bugs.

Treat all agent output as untrusted until a machine check says otherwise. The goal is guardrails that block at the moment of creation (pre-commit) and again before merge (CI), plus policy files that steer the agent up front. Additive and reversible — never weaken an existing check to make the setup "pass".

Phase 0 — Detect stack and existing protection