feat: initial agent identity provisioning automation [#442]

Playwright-based tool for enrolling AI agent identities in Cloudron,
generating API keys via SSO (Gitea/Discourse/Redmine), and storing
all credentials in Bitwarden per-agent collections.

- provision-agent.py: main Playwright automation (Cloudron enroll,
  SSO login, API key generation, verification)
- bw-helper.py: Bitwarden CLI wrapper (password gen, item CRUD,
  TOTP, session management)
- Dockerfile: Playwright v1.52.0 + bw CLI + Python deps
- agents.yaml.example: manifest template for Q3/Q4 agents
- TSYSGroupAIOS framework adopted (hooks, rules engine, Makefile)

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

scripts/setup-hooks.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# setup-hooks.sh — install this repo's git hooks.
+#
+# Mechanism: copy scripts/pre-commit and scripts/pre-push into .git/hooks/ and
+# make them executable. This is the most portable pattern (works on any clone,
+# no `git config core.hooksPath` mutation, survives config resets, idempotent).
+#
+# Run once after cloning:   bash scripts/setup-hooks.sh
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck disable=SC1091
+source "$HERE/lib/common.sh"
+REPO_ROOT="$(repo_root)"
+cd "$REPO_ROOT"
+
+[ -d .git ] || die "no .git directory here — run this from a git checkout"
+
+HOOKS_DIR=".git/hooks"
+HOOK_NAMES="pre-commit pre-push"
+
+log_step "Installing git hooks"
+for name in $HOOK_NAMES; do
+    src="scripts/$name"
+    dst="$HOOKS_DIR/$name"
+    [ -f "$src" ] || die "source hook not found: $src"
+    cp "$src" "$dst"
+    chmod +x "$dst"
+    log_ok "installed $dst"
+done
+
+cat <<EOF
+
+Git hooks installed. The following now run automatically:
+
+  pre-commit  fast rule audit (shellcheck, image pinning, container naming,
+              required files, doc freshness, Discourse pointers, WORKING.md
+              completion, hygiene).
+              Hot-path bypass for STATUS.md / WORKING.md.
+  pre-push    full rule audit (includes scripts/test.sh) + clean-working-tree gate.
+
+Bypass either with \`git commit --no-verify\` / \`git push --no-verify\`
+(emergencies only).
+EOF