chore: initial import from KNEL/PFVCluster@041d311 [#769]

Split per O&M lane work order. Full history: KNEL/PFVCluster.
shellcheck debt fixed in librenms-agent (quoting, arithmetic, backticks);
fixes upstream ntp-server.sh bug: input_wakeups reported PACKETSENDFAILURES
instead of INPUTWAKEUPS. mysql.sh (PHP-in-.sh) exempt per house rule.

https://projects.knownelement.com/issues/769#note-4152

scripts/pre-commit

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# pre-commit — fast rule audit (< 1s typical).
+# Hot-path bypass: commits that ONLY touch STATUS.md / WORKING.md skip the
+# audit so frequent status/task commits stay frictionless.
+set -euo pipefail
+
+REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd "$REPO_ROOT"
+
+CHANGED="$(git diff --cached --name-only)"
+HOT_PATHS="$(printf '%s\n' "$CHANGED" | grep -vE '^(STATUS.md|WORKING.md)$' || true)"
+
+if [ -z "$HOT_PATHS" ]; then
+    echo "hot-path files only (STATUS/WORKING) — skipping rule audit"
+    exit 0
+fi
+
+if ! bash scripts/check-rules.sh --fast; then
+    echo ""
+    echo "pre-commit audit FAILED. Fix the violations above before committing."
+    echo "Full audit:  bash scripts/check-rules.sh"
+    echo "Bypass:      git commit --no-verify   (emergencies only)"
+    exit 1
+fi
+exit 0