Template
Port of the PFVCluster gate to the global PreToolUse copy (all lanes): prod-target remote.sh/remote-dns.sh invocations block without a filed GLPI Change id (.crush/active-cr); dev-lane targets exempt; CR tooling exempt. JSON error payload per house style. Functionally verified. https://projects.knownelement.com/issues/767#note-4191