feat(claude): add 6 lifecycle hooks reinforcing template hard rules

Project-level Claude Code hooks committed to .claude/settings.json with
scripts under .claude/hooks/. Three tiers:

Tier 1 — hard guards (exit 2 to block the tool call):
- bash-guard.sh: blocks bypass flags (verify-skip, sign-skip), forceful
  push variants, destructive resets, force clean, working-tree-wipe
  checkouts/restores, force branch delete, amend, and rm -rf against
  root or home. Reinforces CLAUDE.md Git Safety Protocol.
- generator-first-nudge.sh: blocks creating a new top-level
  packages/<name> or apps/<name> directory by hand. Allows working
  inside an existing package. Reinforces the non-negotiable
  generator-first rule.

Tier 2 — context injection (stdout becomes additional context):
- session-start.sh: prints glossary, AGENTS.md, workflow CLI, and
  conformance pointers on session boot.
- prompt-context.sh: keyword-matches the user prompt against eight
  concept groups (events, realtime, audit, instrumentation, manifest,
  workflow, DI, boundaries) and injects the relevant ADR + rule
  pointers for the turn.

Tier 3 — side-effect automation:
- post-manifest-edit.sh: when Edit/Write touches feature.manifest.ts,
  prints the manifest-first ordering reminder plus the per-feature
  verify commands.
- stop-check-manifest-tests.sh: at agent Stop time, if the working
  tree has manifest changes but no sibling test changes, exits 2 to
  force continuation. Loop-guarded via stop_hook_active.

All hooks are bash + jq, use CLAUDE_PROJECT_DIR for safety, and were
smoke-tested end-to-end (block + allow paths both verified).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/hooks/prompt-context.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Tier 2 — injects relevant ADR + workflow pointers when the user's prompt
+# mentions concepts covered by an ADR or a hard ordering rule.
+# stdout is appended to the agent's context for this turn.
+
+set -euo pipefail
+
+input=$(cat)
+prompt=$(printf '%s' "$input" | jq -r '.prompt // ""' | tr '[:upper:]' '[:lower:]')
+
+inject=()
+
+if echo "$prompt" | grep -qE 'event|publish|consume|cross-feature|job queue'; then
+  inject+=('Events/jobs: ADR-015 + docs/guides/events-and-jobs.md. Rules E0 (events for cross-feature only), E1 (handlers private), J0 (jobs for deferred work).')
+fi
+if echo "$prompt" | grep -qE 'realtime|socket\.io|channel|broadcast|presence'; then
+  inject+=('Realtime: ADR-016 + docs/guides/realtime.md. Rules R0 (state delivery only), R1 (handlers private), R2 (socket.io in core-realtime only).')
+fi
+if echo "$prompt" | grep -qE 'audit|compliance|gdpr|dpa|erasure'; then
+  inject+=('Audit: ADR-018 + docs/guides/audit-and-compliance.md. Optional core; scaffold with pnpm turbo gen core-package audit.')
+fi
+if echo "$prompt" | grep -qE 'sentry|otel|opentelemetry|tracing|instrumentation|pii|scrub'; then
+  inject+=('Instrumentation: ADR-014 (interfaces) + ADR-017 (OTel migration). PII rules non-negotiable: sendDefaultPii=false, server-side scrub at OTel processor layer.')
+fi
+if echo "$prompt" | grep -qE 'use case|use-case|controller|repository|feature\.manifest|new feature|scaffold'; then
+  inject+=('Manifest-first ordering: (1) manifest → (2) contracts (xInputSchema, xOutputSchema, IXUseCase) → (3) tests (red) → (4) impl (green). Use pnpm turbo gen feature/event/job/realtime — never hand-roll.')
+fi
+if echo "$prompt" | grep -qE 'prd|epic|story|task|sandcastle|dispatch|orchestrat'; then
+  inject+=('Workflow: docs/architecture/agent-first-workflow-and-conformance.md + ADR-019. PRDs live in docs/work/prds/ — use the to-prd skill. Stress-test plans with grill-with-docs.')
+fi
+if echo "$prompt" | grep -qE 'di container|inject|bind-production|bind-dev-seed|symbols'; then
+  inject+=('DI: ADR-008 (per-feature containers). Binders take ctx from core-shared/di. Use .toDynamicValue() for factory bindings. Tests inject mocks directly — no container rebinding.')
+fi
+if echo "$prompt" | grep -qE 'boundary|boundaries|cross-package|cross feature'; then
+  inject+=('Boundaries: ADR-006 + ADR-010. Five tags (app|core|core-composition|feature|tooling). Features may only depend on core + tooling. Enforced by ESLint + Turborepo boundaries.')
+fi
+
+if [ ${#inject[@]} -gt 0 ]; then
+  echo "=== context-relevant pointers (from .claude/hooks/prompt-context.sh) ==="
+  printf -- '- %s\n' "${inject[@]}"
+fi
+
+exit 0