feat: bootstrap meta — cross-project best-practices template

Extract patterns from 18 projects across two machines (12 local infra +
6 remote personal/business via ssh survey). Ship a reusable Gitea template
with AGENTS.md, 5 Crush PreToolUse hooks, git pre-commit/pre-push, a
generalized rules engine, shared bash library, Makefile, lifecycle scripts,
and gardening loop. Includes the canonical BASELINE-PROMPT.md (13 sections)
and PATTERNS.md (standardization scorecard).

The repo self-applies: it passes its own shellcheck (zero info-level),
make fast, and all check-rules.sh checks.

💘 Generated with Crush

Assisted-by: Crush via Crush <crush@charm.land>

scripts/setup-hooks.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# setup-hooks.sh — install this repo's git hooks.
+#
+# Mechanism: copy scripts/pre-commit and scripts/pre-push into .git/hooks/ and
+# make them executable. This is the most portable pattern (works on any clone,
+# no `git config core.hooksPath` mutation, survives config resets, idempotent).
+#
+# Run once after cloning:   bash scripts/setup-hooks.sh
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck disable=SC1091
+source "$HERE/lib/common.sh"
+REPO_ROOT="$(repo_root)"
+cd "$REPO_ROOT"
+
+[ -d .git ] || die "no .git directory here — run this from a git checkout"
+
+HOOKS_DIR=".git/hooks"
+HOOK_NAMES="pre-commit pre-push"
+
+log_step "Installing git hooks"
+for name in $HOOK_NAMES; do
+    src="scripts/$name"
+    dst="$HOOKS_DIR/$name"
+    [ -f "$src" ] || die "source hook not found: $src"
+    cp "$src" "$dst"
+    chmod +x "$dst"
+    log_ok "installed $dst"
+done
+
+cat <<EOF
+
+Git hooks installed. The following now run automatically:
+
+  pre-commit  fast rule audit (shellcheck, image pinning, required files,
+              doc freshness, WORKING.md completion, hygiene).
+              Hot-path bypass for STATUS.md / JOURNAL.md / WORKING.md.
+  pre-push    full rule audit (includes make test) + clean-working-tree gate.
+
+Bypass either with \`git commit --no-verify\` / \`git push --no-verify\`
+(emergencies only).
+EOF