Model-source carve-out in agent instructions #50

Part of #43.

Constraint 1 in src/dsagt/dsagt_instructions.md forbids direct data access, explicitly including listing data directories, scanning files, and previewing samples, even when a built-in shell or editor tool would work.

Model source code is not data, so reading it directly is correct, and the dataset builder depends on being able to do it (reading a training loop or model definition is the highest-signal way to derive the consumer contract). But the boundary is not written down anywhere, so agents will behave inconsistently at exactly the point where it matters: some will refuse to read a model file, others will read a data file thinking the carve-out covers it.

Scope

• State the rule: source code is read directly; data is only ever touched through registered codes.
• State the companion rule: a shape or dtype inferred by static reading is a hypothesis, not a conclusion. Keyword arguments, configuration-driven construction, dynamic shapes, and shape logic buried in a trainer all defeat static reading, so an inferred shape must be verified by execution before it enters a contract.

Acceptance criteria

• dsagt_instructions.md updated.
• The same rule referenced from the dataset-builder skill body, so it applies whether or not the pipeline-builder instructions are loaded (the builder is meant to work standalone).