feat: bootstrap meta — cross-project best-practices template

Extract patterns from 18 projects across two machines (12 local infra +
6 remote personal/business via ssh survey). Ship a reusable Gitea template
with AGENTS.md, 5 Crush PreToolUse hooks, git pre-commit/pre-push, a
generalized rules engine, shared bash library, Makefile, lifecycle scripts,
and gardening loop. Includes the canonical BASELINE-PROMPT.md (13 sections)
and PATTERNS.md (standardization scorecard).

The repo self-applies: it passes its own shellcheck (zero info-level),
make fast, and all check-rules.sh checks.

💘 Generated with Crush

Assisted-by: Crush via Crush <crush@charm.land>

hooks/enforce-bash.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Hook: enforce-bash (PreToolUse, matcher: ^bash$)
+# Intercepts every bash tool call and blocks two classes of violation:
+#   1. Banned host-mutating / network commands (per AGENTS.md policy).
+#   2. Host-level language toolchains — they must run inside Docker so the
+#      host stays clean.
+set -euo pipefail
+
+CMD="${CRUSH_TOOL_INPUT_COMMAND:-}"
+
+# --- 1. Banned commands -----------------------------------------------------
+# Extend PROJECT_BANNED_COMMANDS (space-separated) via env to add project-specific bans.
+BANNED_COMMANDS="${PROJECT_BANNED_COMMANDS:-sudo su doas apt apt-get dnf emerge pacman yum zypper apk opkg curl wget ssh scp telnet nc firefox chrome safari httpie}"
+for bc in $BANNED_COMMANDS; do
+    if printf '%s' "$CMD" | grep -qE "(^|[[:space:]])${bc}([[:space:]]|$)"; then
+        echo "BLOCKED: AGENTS.md — '$bc' is a banned command. This project is Docker-only; do host work through containers or approved wrappers." >&2
+        exit 2
+    fi
+done
+
+# --- 2. Host-level language tools ------------------------------------------
+# python3/go/node/npm/cargo/etc. must appear inside a `docker run|exec|build`.
+if printf '%s' "$CMD" | grep -qE '(^|[[:space:]])(python3?|go test|go vet|gofmt|go run|node|npm|npx|yarn|pnpm|ruby|java|javac|rustc|cargo)([[:space:]]|$)'; then
+    if ! printf '%s' "$CMD" | grep -qE 'docker (run|exec|build)'; then
+        echo "BLOCKED: AGENTS.md — language tools must run inside Docker, not on the host. Use: scripts/docker-run.sh <pinned-image> <command>" >&2
+        exit 2
+    fi
+fi
+
+echo '{}'