Fix/dependabot pytest pygments

.github/agents/designer.agent.md

@@ -152,5 +152,6 @@ Apply all relevant disciplines — a fullstack integration system needs API cont
 - `@#docs` — keep design artifacts and related docs aligned with delivered changes
 - `@#explore` — codebase discovery and mapping
 - `@#analyse` — impact analysis, tradeoffs, feasibility
+- `@#openapi` — OpenAPI 3.1 spec writing and review
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->

.github/agents/engineer.agent.md

@@ -144,5 +144,10 @@ Only delegate when workstreams are genuinely independent.
 - `@#performance` — performance investigation
 - `@#container` — Dockerfile and docker-compose authoring
 - `@#cicd` — GitHub Actions CI/CD workflow configuration
+- `@#migrate` — database migration review and authoring
+- `@#refactor` — structured refactoring without behavior change
+- `@#openapi` — OpenAPI 3.1 spec writing and review
+- `@#dependency` — dependency health audit
+- `@#incident` — incident analysis and post-mortem writing
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->

.github/agents/product.agent.md

@@ -142,6 +142,7 @@ Before PR merge, consolidate relevant content into baseline docs and remove the
 - `@#explore` — codebase discovery and mapping (brownfield intake)
 - `@#analyse` — impact analysis, tradeoffs, feasibility
 - `@#adr` — architecture decision record writing (if significant decisions)
+- `@#onboard` — contributor onboarding guide generation
 
 ## gate moments
 

.github/agents/tester.agent.md

@@ -176,5 +176,8 @@ Browser/E2E tests: only if the product scope includes a frontend UI.
 - `@#explore` — codebase discovery and mapping
 - `@#analyse` — impact analysis, tradeoffs, feasibility
 - `@#code-review` — pre-merge review before release
+- `@#migrate` — database migration safety review
+- `@#dependency` — dependency vulnerability and health audit
+- `@#incident` — incident analysis and post-mortem writing
 
 <!-- AUTO-GENERATED — maintained by vstack, do not edit directly -->

.github/copilot-instructions.md

@@ -17,17 +17,31 @@ vstack provides structured skills for backend/microservice development, executab
 ```
 src/vstack/      ← Python package (source of truth)
 src/vstack/_templates/
-├── skills/<name>/template.md   ← skill source templates (edit these)
+├── skills/<name>/
+│   ├── template.md             ← skill body (edit these)
+│   └── config.yaml
 ├── skills/_partials/           ← shared partial snippets
-└── agents/<name>/
-    ├── template.md             ← agent instructions body
-    └── config.yaml             ← agent frontmatter fields
+├── agents/<name>/
+│   ├── template.md             ← agent instructions body
+│   └── config.yaml             ← agent frontmatter fields
+├── instructions/<name>/
+│   ├── template.md             ← instruction file body
+│   └── config.yaml
+└── prompts/<name>/
+    ├── template.md             ← prompt file body
+    └── config.yaml
 docs/            ← architecture.md, design.md, skills.md, workflow.md, roadmap.md, adr/
-.github/         ← generated output (never edit directly)
+.github/         ← generated output (never edit directly*)
 ├── skills/<name>/SKILL.md
-└── agents/<name>.agent.md
+├── agents/<name>.agent.md
+├── instructions/<name>.instructions.md
+├── prompts/<name>.prompt.md
+└── vstack.json                 ← install manifest (generated)
 ```
 
+*Hand-authored exceptions in `.github/`: `copilot-instructions.md`, `CODEOWNERS`,
+`pull_request_template.md`, `ISSUE_TEMPLATE/`, `workflows/`.
+
 Generated files are written to `.github/` at install time:
 
 ```bash
@@ -44,14 +58,16 @@ When vstack is installed inside its own repo (`.github/agents/` and `.github/ski
 |---|---|
 | `src/vstack/_templates/agents/<name>/config.yaml` or `template.md` | `python3 -m vstack install` |
 | `src/vstack/_templates/skills/<name>/template.md` or `_partials/*.md` | `python3 -m vstack install` |
+| `src/vstack/_templates/instructions/<name>/template.md` | `python3 -m vstack install` |
+| `src/vstack/_templates/prompts/<name>/template.md` | `python3 -m vstack install` |
 
-A single command handles both:
+A single command handles all artifact types:
 
 ```bash
 python3 -m vstack install
 ```
 
-Never edit `.github/agents/` or `.github/skills/` directly — changes will be overwritten.
+Never edit `.github/agents/`, `.github/skills/`, `.github/instructions/`, or `.github/prompts/` directly — changes will be overwritten.
 
 ## Execution Model