feat: insights follow-ups — empirical-first debugging, staging guard, invariants

From the 2026-06-11 usage report. The debug skill gains a hypothesis-discipline contract (rank candidate causes by cheapest empirical test, run probes in parallel, report only confirmed findings) targeting the serial theory-cycling the report flagged. commits.md's pre-commit checklist gains a staged-files guard covering the untracked-set and canonical-vs-mirror conventions. A small tracked CLAUDE.md carries the rulesets mirror invariant at turn zero. Two [#C] pilots filed: a read-only morning ops orchestrator and a monthly session-harvest workflow.

The report's 500-token-cap finding was a mislabel: the underlying transcripts show 529 Overloaded and stream-idle-timeout errors with no token cap configured anywhere, so nothing to change there.

1 files changed, 11 insertions, 0 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..3bce8b2
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,11 @@
+# rulesets — project invariants
+
+## Canonical vs mirror
+
+`claude-templates/.ai/` is canonical; `.ai/` at the repo root is a committed mirror kept in sync by `scripts/sync-check.sh` (enforced by `githooks/pre-commit`). Always edit the canonical side, then run `scripts/sync-check.sh --fix` and commit both together. An edit made only in the `.ai/` mirror gets reverted by the next sync — it has happened, and the revert is silent.
+
+Same shape for language bundles: `languages/` is canonical; the `.claude/` copies installed into consuming projects are synced output, never edited in place.
+
+## Tests
+
+`make test` runs pytest + ERT + bats. Bats suites live in `scripts/tests/` and `.ai/scripts/tests/` and are glob-discovered, so new test files are picked up without Makefile edits.