feat(doorman): badge listener + decoder TDD + deploy scaffolding [#355]

Modern successor of the 2018 Perl doorman (snapshot in legacy/):
bash+coreutils HID decoder, HA webhook dispatch, systemd unit.
Offline decoder suite green (9 tests); shellcheck zero-warning.

Umbrella #345. Work item: https://projects.knownelement.com/issues/355

scripts/setup-hooks.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# setup-hooks.sh — install this repo's git hooks.
+#
+# Mechanism: copy scripts/pre-commit and scripts/pre-push into .git/hooks/ and
+# make them executable. This is the most portable pattern (works on any clone,
+# no `git config core.hooksPath` mutation, survives config resets, idempotent).
+#
+# Run once after cloning:   bash scripts/setup-hooks.sh
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck disable=SC1091
+source "$HERE/lib/common.sh"
+REPO_ROOT="$(repo_root)"
+cd "$REPO_ROOT"
+
+[ -d .git ] || die "no .git directory here — run this from a git checkout"
+
+HOOKS_DIR=".git/hooks"
+HOOK_NAMES="pre-commit pre-push"
+
+log_step "Installing git hooks"
+for name in $HOOK_NAMES; do
+    src="scripts/$name"
+    dst="$HOOKS_DIR/$name"
+    [ -f "$src" ] || die "source hook not found: $src"
+    cp "$src" "$dst"
+    chmod +x "$dst"
+    log_ok "installed $dst"
+done
+
+cat <<EOF
+
+Git hooks installed. The following now run automatically:
+
+  pre-commit  fast rule audit (shellcheck, image pinning, container naming,
+              required files, doc freshness, Discourse pointers, WORKING.md
+              completion, hygiene).
+              Hot-path bypass for STATUS.md / WORKING.md.
+  pre-push    full rule audit (includes scripts/test.sh) + clean-working-tree gate.
+
+Bypass either with \`git commit --no-verify\` / \`git push --no-verify\`
+(emergencies only).
+EOF