Local CI Parity & Bootstrap

Purpose
- Provide a portable CI toolchain via a Dockerized image and compose file so that format/lint/build checks run identically locally and in CI.

Components
- `docker/ci.Dockerfile` – builds the CI image with shellcheck, shfmt, hadolint, actionlint, yamllint, Node tools.
- `docker/ci.compose.yml` – runs the CI container mounting the repo at `/workspace`.
- `scripts/ci` – wrapper for phases: `format`, `lint`, `build`, `test`, `security`, `all`.
- Git hooks – `.githooks/*` installed via `scripts/setup-hooks`.

Usage
- Install hooks: `make -f scripts/Makefile hooks-setup`
- Quick checks: `make -f scripts/Makefile quick` (format + lint)
- Full pass: `make -f scripts/Makefile check` (all phases)

Notes
- Pre-commit hook runs format/lint and commit message checks.
- Pre-push hook runs build/test/security placeholders.
- CI workflow runs on integration and protected branches when runners are enabled.