fix: tighten agent patch hygiene

tests/test_agent.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from lai_automation.agent import MiniSWEAgentRunner
+from lai_automation.agent import _SYSTEM_TEMPLATE, MiniSWEAgentRunner
 from lai_automation.models import Issue
 
 
@@ -18,3 +18,10 @@ def test_task_uses_issue_text_not_github_parser() -> None:
     assert "Issue #42: Wrong result" in task
     assert issue.html_url in task
     assert issue.body in task
+
+
+def test_system_prompt_requires_precise_diff_hygiene() -> None:
+    assert "Never create backup files" in _SYSTEM_TEMPLATE
+    assert "Preserve unrelated lines exactly" in _SYSTEM_TEMPLATE
+    assert "inspect all key columns and cardinality" in _SYSTEM_TEMPLATE
+    assert "remove trailing spaces" in _SYSTEM_TEMPLATE

tests/test_policy.py

@@ -44,6 +44,22 @@ def test_rejects_protected_paths(settings, filename: str) -> None:
         validate_changes(workspace_with_no_symlinks(), summary, settings)
 
 
+@pytest.mark.parametrize(
+    "filename",
+    [
+        "config/erp_semantics.php.backup",
+        "app/Service.php.orig",
+        "test_debug.php",
+        "scratch.php",
+    ],
+)
+def test_rejects_temporary_artifacts(settings, filename: str) -> None:
+    summary = ChangeSummary((filename, "app/Fix.php"), 2, 0)
+
+    with pytest.raises(ValueError, match="Temporary artifact"):
+        validate_changes(workspace_with_no_symlinks(), summary, settings)
+
+
 def test_rejects_git_metadata_created_in_worktree(settings) -> None:
     workspace = workspace_with_no_symlinks()
     workspace.has_path.return_value = True