Executable agent guardrails for tools other than Claude Code

Under #13 only Claude Code receives executable configuration in a generated project — the `.claude/settings.json` on-`main` branch guard, the commit/push permission prompts, and the `new-branch` skill. Every other selectable tool gets a pointer file and nothing else, so a developer on Cursor or Codex has the prose guardrails but none of the enforcement.

That asymmetry was deliberately left out of #13's scope as speculative, and this issue exists so it's tracked rather than buried in an out-of-scope paragraph. Open questions: whether the branch guard is even expressible in each tool's config model, and whether the skill has a portable equivalent or is Claude-specific by nature.

Came out of an ideation session around #13, not a scoped request.

Start by reading issue #13 and the existing .claude/settings.json configuration, including the main-branch guard, permission prompts, and new-branch skill. Compare how the other selectable tools represent these controls and record which behaviors are expressible or tool-specific. Done means the supported scope and any explicit limitations are defined.

Written by the indexing model from the issue text.