chore: adopt TSYSGroupAIOS framework (git hooks, rules engine, SoR policy)

Brings in the enforcement layer from ~/daytoday/meta:
- Makefile, scripts/ (check-rules.sh, setup-hooks.sh, pre-commit/pre-push,
  docker-run.sh, garden.sh, lib/common.sh)
- WORKING.md, questions-v1.md, .env.example
- Git hooks installed (pre-commit: fast audit, pre-push: full audit)

Fixes to pass rule audit:
- Pin Pi-hole/autoheal Docker images (no :latest tags)
- Fix shellcheck SC2001 in probe-vm-dns.sh
- Prune vendor/ and archive/ from shellcheck + Discourse pointer checks
- Add Quick Start, Enforcement Model, Task Tracking, Working Style
  sections to AGENTS.md from template

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

WORKING.md

@@ -0,0 +1,9 @@
+# WORKING.md — Active Session Tracker
+
+Agent work only. The human decides when it's done.
+The todos tool is banned; this is the only task tracker.
+A commit is blocked while any task below remains unchecked.
+
+## Current Tasks
+
+(none — all agent work is committed)