feat(hooks): add ticket-gate Crush hook — enforce ticket-first work

Mechanically enforces ticket-governed work: blocks modifying operations
until an active ticket is set (echo '#NNN' > .crush/active-ticket).
Exempts read-only tools and management commands.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

AGENTS.md

@@ -60,6 +60,7 @@ Replace this bracketed text.>
 
 - **Redmine** is the single system of record for ALL project work — tickets, schedules, Gantt, dependencies. Use the `redmine-cli`. **Do not use Gitea issues.** Reference tickets as `[#NNN]`.
 - **NEVER close a Redmine ticket without explicit user permission.** You may SUGGEST a close when the result is clearly scoped and delivered. If it's ambiguous whether the work is truly complete, don't suggest a close — leave that decision to the user. This applies to ALL tickets, no exceptions.
+- **Ticket-first enforcement (mechanically enforced).** Before starting any work, set the active ticket: `echo '#NNN' > .crush/active-ticket`. The Crush hook (`hooks/ticket-gate.sh`) blocks modifying operations until this file exists. If no ticket exists, CREATE ONE FIRST via redmine-cli, then set it. Clear when done: `> .crush/active-ticket`.
 - **Discourse** is the single system of record for documentation. Use the `discourse-cli`. **Do not author long-form docs in gitea.**
 - **Git-tracked `.md` files are stubs** that point to the relevant Discourse topic URL. Operational files that must live next to code (`AGENTS.md`, `STATUS.md`, `questions-v*.md`) are the documented exceptions.
 - `STATUS.md` is a scratchpad for token efficiency, **not** a system of record.