Move recurring bug patterns to copilot-instructions, keep skill workflow-only

The hardware-deploy skill should only cover deploy/debug workflow. General
code-review pitfalls (input validation, NULL-sentinel APIs, SD file handle
lifecycle) apply to any code review in this repo, not just hardware deploy
sessions, so they belong in the always-loaded copilot-instructions.md
instead, generalized as patterns rather than pointers to specific fixed
bugs.

Author: networkfusion

.github/copilot-instructions.md

@@ -219,6 +219,11 @@ Do not invoke libdragon tools directly unless debugging the build system. Prefer
 - Keep behavior identical unless the bug itself requires behavior change.
 - After edits, validate touched files and summarize exactly which findings were fixed.
 
+### Recurring pitfall patterns (watch for these on any review)
+- **Unchecked ints from user-editable config**: any value parsed from a `.ini`/config file (e.g. `rom_offset`) must be range-checked before use in pointer/size arithmetic like `SIZE - value`, which silently underflows on out-of-range input.
+- **NULL-sentinel API arguments**: avoid a single parameter meaning two different things depending on whether it's NULL (e.g. "use this new value" vs "reuse whatever was last set"). Split into a setter + a no-arg action function instead.
+- **Multiple SD card file handles open at once**: closing/reopening one SD-backed resource (e.g. audio player track) while another SD file handle from a different subsystem (e.g. custom BGM) is still open can corrupt the second open. Always close the first subsystem's handle before initializing/reopening another SD-backed resource.
+
 ### Minimal Change Policy (Strict)
 - Be laser-focused on the exact user request; do not broaden scope.
 - Do not refactor unless the user explicitly asks for refactoring.

.github/skills/n64flashcartmenu-hardware-deploy/SKILL.md

@@ -98,8 +98,4 @@ docker exec <container> bash -c "sc64deployer --remote host.docker.internal:9064
 
 If this fails with `Couldn't init the SD card: SD card is locked by the N64 side`, the console is currently powered on and has the SD card mounted — **ask the user to power off the console**, then retry. `sc64deployer reset` alone is not sufficient; the console must actually be off.
 
-## Known code gotchas (src/menu)
-
-- `sound.c`/`sound.h`: BGM/SFX subsystem. Avoid NULL-sentinel-argument APIs (e.g. `sound_init_bgm(char*)` meaning "new path" vs "reuse last path" depending on NULL) — split into a setter (`sound_set_bgm_path`) + no-arg action (`sound_init_bgm(void)`) instead.
-- `views/music_player.c` `deinit()`: must call `audioplayer_deinit()` (closes the SD file handle of the currently playing track) **before** `sound_init_default()` (which may reopen a custom SD-based BGM file) — two SD files open at once corrupts the second `wav64_t`, tripping the `wave->channels == 1 || wave->channels == 2` assertion in `mixer_ch_play`.
-- `cart_load.c`: any numeric value parsed from a user-editable `.ini` file (e.g. `rom_offset`) must be bounds-checked before use in pointer/size arithmetic like `MiB(64) - rom_offset`, which silently underflows on an out-of-range input.
+For general code-review pitfalls (input validation, resource lifecycle, etc.), see `.github/copilot-instructions.md`.