feat: bootstrap repo — enforcement layer + #685 perf capture

Enforcement (check-rules/hooks/shellcheck) per ADOPTING pattern; perf/ SoR
from the #685 session (memcensus, pg role-caps SQL, applied sysctl, planned
daemon.json); questions-v1 (API token + dockerd window asks).

Meat + verification: https://projects.knownelement.com/issues/727#note-3913

.env.example

@@ -0,0 +1,7 @@
+# KNEL/cloudron — credential REFS only.
+# Material secrets live in ~/.creds (0600). NEVER commit real values here.
+#
+# Pending founder ask (#685/#727): Cloudron API token.
+# When issued, store the material value in ~/.creds/cloudron.env as:
+#   CLOUDRON_API_TOKEN=<token>
+CLOUDRON_API_TOKEN=