feat(hooks): add ticket-gate Crush hook — enforce ticket-first work

Mechanically enforces the Agent Authority policy: blocks all modifying
operations (bash, edit, write, multiedit) until an active ticket is set
via: echo '#NNN' > .crush/active-ticket

Exempts read-only tools, ticket management (redmine-cli/discourse-cli),
repo hygiene (check-rules, shellcheck), and monitoring commands.

Also: un-ignore .crush/crush.json so the hook config is tracked in git.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

AGENTS.md

@@ -130,6 +130,11 @@ for a full audit or `--fast` for pre-commit speed. Bypass with `--no-verify`
 - **Redmine is the system of record for all work.**
 - **NEVER close a ticket without explicit user permission.** Suggest a
   close when clearly scoped/delivered; if ambiguous, don't suggest.
+- **Ticket-first enforcement (mechanically enforced).** Before starting
+  any work, set the active ticket: `echo '#NNN' > .crush/active-ticket`.
+  The Crush hook (`hooks/ticket-gate.sh`) blocks modifying operations
+  until this file exists. If no ticket exists, CREATE ONE FIRST via
+  redmine-cli, then set it. Clear when done: `> .crush/active-ticket`.
 - **WORKING.md** is the only in-repo task tracker — a scratchpad for the current
   session. The pre-commit hook blocks commits while any task remains unchecked.
 - Clear WORKING.md before responding to the user.