Reduce avoidable approval prompts from independent shell batches

[Aaronontheweb]

Summary

• freeze a sanitized post-Reduce project scope declaration misses #1990 live sample where four of ten shell calls prompted because independent diagnostics were batched
• add generic one-operation-per-call guidance across always-loaded rules, shell metadata, and the bundled operations skill
• strengthen the fresh-session eval so compound commands or unsuccessful shell results cannot pass
• keep authored compound calls approval-gated and lock those outcomes in the coordinator evidence corpus

This changes model guidance only. It adds no grant, safe verb, shell-authority rule, executable-specific parser, public API, or persistence format.

Measured behavior

Using the same five-run task and primary model configuration:

• behavior completion: 3/5 to 5/5
• shell calls: 6 to 5
• compound shell calls: 1 to 0
• approval-equivalent events: 1 to 0

Validation

• full pre-rebase solution run: 7,562 passed; 15 expected skips
• post-Fix deterministic CI failures across active pull requests #1991 rebase Release build: clean
• post-rebase focused interaction set: 445 passed; 1 expected Windows-only skip
• changed-file Slopwatch: 0 findings
• strict OpenSpec, changed-file formatting, headers, Bash syntax, JSON, and diff checks: pass
• exact candidate binary swapped locally and daemon health verified