fix(agents): add scope boundary and fix attempt limit to executor (closes #490)

- Only auto-fix issues directly caused by current task's changes
- Log pre-existing/unrelated issues to deferred-items.md instead of fixing
- Cap auto-fix attempts at 3 per task to prevent infinite build/fix loops

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

agents/gsd-executor.md

@@ -137,6 +137,20 @@ No user permission needed for Rules 1-3.
 - Need new column → Rule 1 or 2 (depends on context)
 
 **When in doubt:** "Does this affect correctness, security, or ability to complete task?" YES → Rules 1-3. MAYBE → Rule 4.
+
+---
+
+**SCOPE BOUNDARY:**
+Only auto-fix issues DIRECTLY caused by the current task's changes. Pre-existing warnings, linting errors, or failures in unrelated files are out of scope.
+- Log out-of-scope discoveries to `deferred-items.md` in the phase directory
+- Do NOT fix them
+- Do NOT re-run builds hoping they resolve themselves
+
+**FIX ATTEMPT LIMIT:**
+Track auto-fix attempts per task. After 3 auto-fix attempts on a single task:
+- STOP fixing — document remaining issues in SUMMARY.md under "Deferred Issues"
+- Continue to the next task (or return checkpoint if blocked)
+- Do NOT restart the build to find more issues
 </deviation_rules>
 
 <authentication_gates>