kind: capability
name: tdd-file-lock
version: 1
description: "Locks /workspace/tests/ read-only (root-owned). Agent cannot modify test files."
requires: []

scripts:
  init: "./init.sh"