feat: bootstrap repo — enforcement layer + #685 perf capture

Enforcement (check-rules/hooks/shellcheck) per ADOPTING pattern; perf/ SoR
from the #685 session (memcensus, pg role-caps SQL, applied sysctl, planned
daemon.json); questions-v1 (API token + dockerd window asks).

Meat + verification: https://projects.knownelement.com/issues/727#note-3913

questions-v1.md

@@ -0,0 +1,28 @@
+# questions-v1.md — KNEL/cloudron open asks (2026-09-02)
+
+> Working ask-file for this repo. Answer inline; agent checks before asking
+> again. Version up (v1 → v2...) each round answers land. Fleet-wide asks also
+> live in KNEL/PFVCluster questions-09022206.md.
+
+## 1. Cloudron API token — unblocks API-first access (asks also in #685/#727)
+
+The #685 investigation ran over raw SSH (root@my.knownelement.com) because no
+panel API token exists. A token lets the agent use the Cloudron API (apps,
+configs, backups) instead of shell — cleaner audit trail, and the path for
+future AWX/Ansible modules.
+
+- [ ] Create an API token (panel: my.knownelement.com → your profile → API
+      access, or `cloudron token create` via CLI) with read scope at minimum
+- [ ] Drop the material value in `~/.creds/cloudron.env` as
+      `CLOUDRON_API_TOKEN=<token>` (never in this repo)
+
+## 2. docker daemon.json bounce window (see README "Ground truth")
+
+Applying `perf/docker-daemon.json.planned` (nofile 262144 default + log
+rotation + live-restore) requires ONE dockerd restart — every container
+bounces (~300). live-restore is currently false so there is no zero-downtime
+path. Until then the postgres nofile bridge is ephemeral (lost on postgres
+container recreate).
+
+- [ ] Pick a window (suggest: pre-storm weekday morning) — agent will ticket
+      the runbook + execute on your go