feat(hooks): add ticket-gate Crush hook — enforce ticket-first work

Mechanically enforces the Agent Authority policy: blocks all modifying
operations (bash, edit, write, multiedit) until an active ticket is set
via: echo '#NNN' > .crush/active-ticket

Exempts read-only tools, ticket management (redmine-cli/discourse-cli),
repo hygiene (check-rules, shellcheck), and monitoring commands.

Also: un-ignore .crush/crush.json so the hook config is tracked in git.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

WORKING.md

@@ -7,10 +7,5 @@ A commit is blocked while any task below remains unchecked.
 
 (all done — session complete)
 
-- [x] Build VM MAC→IP mapping from ARP table + Proxmox data
-- [x] Generate dhcpd.conf host reservations (18 production VMs, current IPs)
-- [x] Deploy reservations to netinfra-01 (syntax check passed, DHCP reloaded)
-- [x] Sync to netinfra-02 (manual trigger, confirmed)
-- [x] Add PTR records in Technitium (18 PTR-only records, verified)
-- [x] Pull updated dhcpd.conf into repo
-- [x] Create #421 (inotify DHCP sync, someday/maybe)
+- [x] Add ticket-gate Crush hook (blocks work without active ticket)
+- [x] Document active-ticket workflow in AGENTS.md + meta template