Require Git hygiene for all agents in this workspace.

Bind commit/push/PR safety, gitea_vps-only remote ops, and secret
scans in AGENTS.md, with CLAUDE.md and Grok rules so every harness loads them.

.grok/rules/git-hygiene.md

@@ -0,0 +1,17 @@
+# Git hygiene (Salon_Assistant)
+
+Mandatory. Full rules: repository root `AGENTS.md` → section **Git hygiene (mandatory)**.
+
+Quick binding rules:
+
+- **gitea_vps only** for this product’s remote Git/PR MCP (`Ty_Tech/Salon_Assistant`). Never `gitea_mcp_for_ty` or localhost Git MCP.
+- **No secrets** in commits, messages, PRs, or issues.
+- **No `git config`** changes.
+- **No force-push to `main`**, no `--no-verify`, no amend of published commits unless the user explicitly orders it.
+- **Commit / push / open-or-merge PR only when the user asks.**
+- Before commit: `status` + staged diff; stage explicit paths only; scan for credentials.
+- Feature work on named branches (`docs/`, `design/`, `chore/`, `fix/`, `feat/`); base PRs on `main`.
+- Confirm before destructive Git (hard reset, clean -fd, remote branch delete, history rewrite).
+- Subagents inherit these rules.
+
+Detail and checklists: `AGENTS.md`, `CONTRIBUTING.md`, `SECURITY.md`.