docs: tighten agent evidence and scoped validation (no release)

[xeonvs]

Summary

The PR template required full Python validation for documentation-only work, while the development guide still described a standard-library-only runtime and help-only package checks. Align the template with scoped validation, point dependency guidance to package metadata, and require changed installed runtime paths to be exercised.

Clarify bounded tool output and evidence reuse: inspect focused ranges, preserve large reports privately, reduce structured results before returning them to the agent, and repeat checks only when inputs or required boundaries justify it. Session audit observations are qualitative; no private transcripts, identifiers, or usage metrics are published.

Classification: no-release. Agent instructions and PR template only; no runtime, packaging, dependencies or CI behavior changes. Installation implementation remains tracked in #214. Workflow audit discovery/output defects are tracked in xeonvs/codex-engineering-workflow#12.

Validation

• Existing operations documentation and integration contracts: 43 passed.
• Semantic review against documentation-only, package-boundary and release tasks; complete diff review and git diff --check passed.
• Pinned repository Gitleaks: staged index, public tree and complete branch history passed.
• SSH commit signature verified.
• The generic workflow privacy scan reported existing findings outside the changed files; it is not reported as green. Repository-owned public-tree validation passed. Related workflow false-positive handling is tracked in Privacy preflight hard-blocks legitimate runbook paths, URI prose, and synthetic fixtures codex-engineering-workflow#8.
• Full local Python matrix is not required for this documentation-only scope; hosted checks remain enabled.

Changed boundaries

Agent instruction and validation-selection guidance only. No new prose-presence tests or runtime wrappers.

Security and compatibility impact

Existing secret, review and release gates remain required. Package-check guidance distinguishes console help from dependency and runtime evidence. No release is requested.