feat: bootstrap meta — cross-project best-practices template

Extract patterns from 18 projects across two machines (12 local infra +
6 remote personal/business via ssh survey). Ship a reusable Gitea template
with AGENTS.md, 5 Crush PreToolUse hooks, git pre-commit/pre-push, a
generalized rules engine, shared bash library, Makefile, lifecycle scripts,
and gardening loop. Includes the canonical BASELINE-PROMPT.md (13 sections)
and PATTERNS.md (standardization scorecard).

The repo self-applies: it passes its own shellcheck (zero info-level),
make fast, and all check-rules.sh checks.

💘 Generated with Crush

Assisted-by: Crush via Crush <crush@charm.land>

hooks/audit-before-git.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Hook: audit-before-git (PreToolUse, matcher: ^bash$)
+# Fires on any bash call containing "git commit" or "git push" and blocks it
+# unless the fast rule audit passes. This makes the git hooks redundant-safe:
+# even if hooks are bypassed or missing, the agent cannot commit/push a
+# rule-violating state.
+set -euo pipefail
+
+CMD="${CRUSH_TOOL_INPUT_COMMAND:-}"
+
+if ! printf '%s' "$CMD" | grep -qE 'git[[:space:]]+(commit|push)'; then
+    echo '{}'
+    exit 0
+fi
+
+# Emergency bypass.
+if printf '%s' "$CMD" | grep -q -- '--no-verify'; then
+    echo '{"context": "Skipping rule audit (--no-verify). Use this ONLY in genuine emergencies."}'
+    exit 0
+fi
+
+REPO_ROOT="${CRUSH_PROJECT_DIR:-$(pwd)}"
+
+if bash "$REPO_ROOT/scripts/check-rules.sh" --fast >/dev/null 2>&1; then
+    echo '{"context": "Rule audit passed."}'
+    exit 0
+fi
+
+# Re-run with output so the violation is visible, then block.
+bash "$REPO_ROOT/scripts/check-rules.sh" --fast >&2 || true
+echo "BLOCKED: rule audit failed. Fix the violations above before committing or pushing." >&2
+exit 2