feat(claude): add 6 lifecycle hooks reinforcing template hard rules

Project-level Claude Code hooks committed to .claude/settings.json with
scripts under .claude/hooks/. Three tiers:

Tier 1 — hard guards (exit 2 to block the tool call):
- bash-guard.sh: blocks bypass flags (verify-skip, sign-skip), forceful
  push variants, destructive resets, force clean, working-tree-wipe
  checkouts/restores, force branch delete, amend, and rm -rf against
  root or home. Reinforces CLAUDE.md Git Safety Protocol.
- generator-first-nudge.sh: blocks creating a new top-level
  packages/<name> or apps/<name> directory by hand. Allows working
  inside an existing package. Reinforces the non-negotiable
  generator-first rule.

Tier 2 — context injection (stdout becomes additional context):
- session-start.sh: prints glossary, AGENTS.md, workflow CLI, and
  conformance pointers on session boot.
- prompt-context.sh: keyword-matches the user prompt against eight
  concept groups (events, realtime, audit, instrumentation, manifest,
  workflow, DI, boundaries) and injects the relevant ADR + rule
  pointers for the turn.

Tier 3 — side-effect automation:
- post-manifest-edit.sh: when Edit/Write touches feature.manifest.ts,
  prints the manifest-first ordering reminder plus the per-feature
  verify commands.
- stop-check-manifest-tests.sh: at agent Stop time, if the working
  tree has manifest changes but no sibling test changes, exits 2 to
  force continuation. Loop-guarded via stop_hook_active.

All hooks are bash + jq, use CLAUDE_PROJECT_DIR for safety, and were
smoke-tested end-to-end (block + allow paths both verified).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/hooks/generator-first-nudge.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Tier 1 — enforces the generator-first rule. Blocks hand-rolled scaffolding
+# under packages/ or apps/ via mkdir/cp/touch. Use `pnpm turbo gen <kind>`.
+
+set -euo pipefail
+
+input=$(cat)
+cmd=$(printf '%s' "$input" | jq -r '.tool_input.command // ""')
+
+# Match creation of a NEW top-level packages/<name>/ or apps/<name>/ directory.
+# Allows working inside an existing package (e.g. `mkdir -p packages/blog/src/foo`).
+patterns=(
+  'mkdir[[:space:]]+(-p[[:space:]]+)?packages/[a-zA-Z0-9_-]+/?([[:space:]]|$)'
+  'mkdir[[:space:]]+(-p[[:space:]]+)?apps/[a-zA-Z0-9_-]+/?([[:space:]]|$)'
+  'cp[[:space:]]+-[rR][[:space:]]+packages/[^[:space:]]+[[:space:]]+packages/[a-zA-Z0-9_-]+/?([[:space:]]|$)'
+)
+
+for pattern in "${patterns[@]}"; do
+  if [[ "$cmd" =~ $pattern ]]; then
+    cat >&2 <<EOF
+BLOCKED by .claude/hooks/generator-first-nudge.sh
+
+This template enforces "generator-first" — hand-rolled scaffolding under
+packages/ or apps/ is forbidden. Use a generator:
+
+  pnpm turbo gen feature              # new vertical feature
+  pnpm turbo gen core-package <name>  # optional core (events|realtime|audit|trpc|ui)
+  pnpm turbo gen event                # event contract or handler
+  pnpm turbo gen job                  # background job
+  pnpm turbo gen realtime             # realtime channel or handler
+  pnpm turbo gen core-ui-component    # atomic-design UI component
+
+If you're modifying an existing package (e.g. \`mkdir -p packages/blog/src/x\`)
+this hook will not block you. If you genuinely need to bypass (e.g. fixing
+the generator itself), ask the user to authorize and re-state the intent.
+
+Command: ${cmd}
+EOF
+    exit 2
+  fi
+done
+
+exit 0