feat: bootstrap repo — enforcement layer + #685 perf capture

Enforcement (check-rules/hooks/shellcheck) per ADOPTING pattern; perf/ SoR
from the #685 session (memcensus, pg role-caps SQL, applied sysctl, planned
daemon.json); questions-v1 (API token + dockerd window asks).

Meat + verification: https://projects.knownelement.com/issues/727#note-3913

perf/docker-daemon.json.planned

@@ -0,0 +1,8 @@
+{
+  "log-driver": "json-file",
+  "log-opts": { "max-size": "10m", "max-file": "3" },
+  "default-ulimits": {
+    "nofile": { "Name": "nofile", "Soft": 262144, "Hard": 262144 }
+  },
+  "live-restore": true
+}