Reduce wasted context: AGENTS.md is re-injected in full on every tool-result <system-reminder> #46208

Problem

Every time a tool result is returned, the runtime appends the full matched AGENTS.md as a <system-reminder> to the context. Because LLM context is cumulative, the same full AGENTS.md ends up occupying the window N times (once per tool result), even though nothing changed.

Measured: a single simple status query triggering 2 tool reads re-injected a ~12-15k-token AGENTS.md twice, i.e. ~25-30k tokens of pure waste for one trivial query.

Root cause

• Injection point is per tool-result, not per assistant turn.
• No content-fingerprinting; identical content is re-appended verbatim.
• The destination model treats each reminder as authoritative instructions, so none get trimmed.

Proposed designs (composable)

1. Content-fingerprint dedup — store (path -> {hash, content}); inject full content only on first message; on later messages with unchanged hash, emit a one-line 'unchanged' marker; on change, emit the diff. Prefer file-content hash (or git blob id) over git ref, since uncommitted changes must also be detected.
2. On-demand instruction loading — keep only a thin scenario->file/section routing table (<2k) resident; fetch sections via a tool (fetch_instruction(file, section)), decoupled from tool returns.
3. Batching / fewer injection points — merge multiple independent reads in one turn into a single returned batch, reducing per-result reminder emissions.
4. Layered mounting — resident layer (identity anchors, hard prohibitions, secret red-lines) always on + deduped; scenario layer loaded only on keyword match; on-demand layer loaded via tools.

Acceptance criteria

• Identical instruction file across K consecutive tool returns appears once as real content + (K-1) 'unchanged' markers.
• A content change is reflected by the next return.
• Safety/resident red-line layer is never dropped by dedup.
• First message still includes full content (avoid cold-start misread).

Non-goals

• Not changing the role of per-scenario files; dedup targets the injection mechanism, not scenario-loading responsibilities.
• Out of scope: multi-session write-locking, inter-instruction relative-link validation.

Local mitigation already applied (project-side, for reference)

• Slimmed the sub-project AGENTS.md (moved large reference tables into per-scenario docs, kept all red-lines/resident rules inline).
• Status queries now read a single authoritative source in one merged call.