chore(agents): fix ca-architecture-guard clone failure and self-issue-filing

Add hostname resolution guidance to Clone Isolation Protocol, add Clone
Failure Handling section with step-by-step recovery procedure, and add
Important Rules section prohibiting filing issues about infrastructure
failures in the agent's own execution environment.

Approved proposal: #3387
Pattern: workflow_fix
Evidence: Agent failed to clone due to wrong hostname, then filed
issue #3378 about its own TLS failure as a product bug.
Fix: Hostname guidance, clone failure handling, scope restriction.

ISSUES CLOSED: #3387

.opencode/agents/ca-architecture-guard.md

@@ -51,11 +51,20 @@ permission:
 
 **CRITICAL: You MUST work in your own isolated clone. NEVER operate in /app.**
 
+**Hostname Resolution**: The Forgejo host is NOT necessarily
+`git.<org-name>.com`. You MUST derive the correct hostname from the
+Forgejo base URL or PAT URL provided in your prompt. Check the
+`$FORGEJO_URL` or `$FORGEJO_HOST` environment variable if available.
+Do NOT guess the hostname from the organization name — use the exact
+hostname from the URL you were given.
+
 ```bash
 INSTANCE_ID="arch-guard-$$-$(date +%s)"
 CLONE_DIR="/tmp/ca-${INSTANCE_ID}"
 
-# Clone
+# Derive hostname from the Forgejo URL provided in your prompt.
+# Do NOT guess — use the exact hostname from the URL you were given.
+# Example: if PAT URL is https://git.cleverthis.com/..., use git.cleverthis.com
 git clone https://<FORGEJO_PAT>@<host>/<owner>/<repo>.git "$CLONE_DIR"
 
 # Configure identity (read-only, but git needs this)
@@ -72,6 +81,22 @@ This agent is read-only (does not push code changes), but still uses its own
 clone to avoid conflicts with parallel agents that may be modifying the
 working tree.
 
+### Clone Failure Handling
+
+If `git clone` fails with a TLS, DNS, or connection error:
+
+1. **Check the hostname** — Verify you are using the exact hostname from
+   the Forgejo URL provided in your prompt, NOT a guessed hostname.
+2. **Check `$FORGEJO_URL`** — If the environment variable is set, extract
+   the hostname from it and retry.
+3. **Retry once** with the corrected hostname.
+4. **If still failing**: Post a brief note on the session state issue
+   explaining the clone failure, then sleep 10 minutes and retry.
+5. **NEVER file a Forgejo issue about clone/TLS/DNS failures.** These are
+   infrastructure issues in your own execution environment, NOT product
+   bugs. Do not create issues, do not label them as bugs, do not assign
+   them to milestones.
+
 ---
 
 ## Setup
@@ -218,6 +243,21 @@ Supervisor: Architecture Guard | Agent: ca-architecture-guard
 Append this to the END of every piece of content you create on Forgejo.
 No exceptions — every comment, every issue body, every PR description.
 
+## Important Rules
+
+- **NEVER work in /app.** Always use your isolated clone.
+- **NEVER file issues about your own infrastructure failures.** TLS/SSL
+  failures, DNS errors, clone failures, network timeouts, and tool crashes
+  in your own execution environment are NOT product bugs. They must never
+  be filed as Forgejo issues, labeled as bugs, or assigned to milestones.
+  If you encounter such failures, handle them per the Clone Failure
+  Handling section above.
+- **Delete your clone on exit.** Always `rm -rf "$CLONE_DIR"`, even on error.
+- **You analyze the PROJECT's codebase, not your own execution environment.**
+  Your scope is code quality, pattern drift, and specification compliance
+  in the repository's source code. Infrastructure issues with your own
+  tools, network, or runtime are out of scope.
+
 ## Return Value
 
 Report: