feat: apply terrarium federation standards

.claude/README.md

@@ -0,0 +1,7 @@
+# `.claude/` — federated harness surface
+
+Federated under [terrarium](https://github.com/cerebral-work/terrarium) standards.
+
+| Hook | Event | What | Bypass |
+|---|---|---|---|
+| `guard-main-push` | PreToolUse Bash | deny direct push to main | `# allow-direct-push` |

.claude/hooks/guard-main-push.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Deny direct push to main/master. Override: "# allow-direct-push".
+input=$(cat); cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""')
+case "$cmd" in *"# allow-direct-push"*) exit 0 ;; esac
+if printf '%s' "$cmd" | grep -qE 'git +push.*(origin +)?(main|master)\b' \
+   || { printf '%s' "$cmd" | grep -qE 'git +push' && [ "$(git branch --show-current 2>/dev/null)" = "main" ]; }; then
+  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny","permissionDecisionReason":"Direct push to main is blocked — open a PR. Override: # allow-direct-push and surface why."}}'
+fi
+exit 0

.claude/settings.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "attribution": { "commit": "", "pr": "" },
+  "permissions": {
+    "allow": [
+      "Bash(git add *)", "Bash(git commit *)", "Bash(git push)",
+      "Bash(git fetch *)", "Bash(git status*)", "Bash(git diff*)",
+      "Bash(git log*)", "Bash(git checkout *)",
+      "Bash(rg *)", "Bash(grep *)", "Bash(jq *)", "Bash(gh pr *)",
+      "Read", "Edit", "Write"
+    ],
+    "deny": ["Bash(rm -rf /*)", "Bash(rm -rf ~)"],
+    "defaultMode": "default"
+  },
+  "hooks": {
+    "PreToolUse": [
+      { "matcher": "Bash", "hooks": [
+        { "type": "command", "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/guard-main-push.sh", "timeout": 5 }
+      ]}
+    ]
+  }
+}

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+*            @todie
+/.claude/    @todie
+/.github/    @todie

lefthook.yml

@@ -0,0 +1,14 @@
+# Conventional Commits + gitleaks (federated standard).
+# Skip: LEFTHOOK=0.
+commit-msg:
+  commands:
+    conventional:
+      run: |
+        head -1 {1} | grep -qE '^(feat|fix|perf|refactor|docs|test|ci|build|infra|security|style|chore)(\(.+\))?!?: .+' \
+          || { echo "commit-msg must be Conventional Commits: <type>(scope): <desc>"; exit 1; }
+
+pre-commit:
+  parallel: true
+  commands:
+    gitleaks:
+      run: gitleaks protect --staged --redact --no-banner || echo "gitleaks not installed — CI will enforce"