chore: adopt TSYSGroupAIOS framework (git hooks, rules engine, SoR policy)

Brings in the enforcement layer from ~/daytoday/meta:
- Makefile, scripts/ (check-rules.sh, setup-hooks.sh, pre-commit/pre-push,
  docker-run.sh, garden.sh, lib/common.sh)
- WORKING.md, questions-v1.md, .env.example
- Git hooks installed (pre-commit: fast audit, pre-push: full audit)

Fixes to pass rule audit:
- Pin Pi-hole/autoheal Docker images (no :latest tags)
- Fix shellcheck SC2001 in probe-vm-dns.sh
- Prune vendor/ and archive/ from shellcheck + Discourse pointer checks
- Add Quick Start, Enforcement Model, Task Tracking, Working Style
  sections to AGENTS.md from template

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

netinfra/pihole/docker-compose.yml

@@ -4,7 +4,7 @@ services:
     # Root cause of the 2026-08 gravity.db corruption: default /dev/shm (64M)
     # was too small for FTL's shared-memory metrics. 1024M has been stable.
     shm_size: '1024M'
-    image: pihole/pihole:latest
+    image: pihole/pihole:2026.07.0
     hostname: pihole
     entrypoint: ["/usr/local/bin/gravity-validate.sh"]
     ports:
@@ -42,7 +42,7 @@ services:
       - dnsnet
   autoheal:
     container_name: autoheal
-    image: willfarrell/autoheal:latest
+    image: willfarrell/autoheal:1.2.0
     environment:
       AUTOHEAL_CONTAINER_LABEL: autoheal
       AUTOHEAL_INTERVAL: 30