chore(mirror): keep the Gitea fallback current from local git (#38)

GitHub is the source of truth; Gitea (origin) is a just-in-case copy that had
drifted two commits behind. Rather than require a credential on GitHub's side
or convert the repo to a read-only Gitea mirror, wire it into the local
workflow:

- scripts/mirror-gitea.sh — pushes prod + all tags to the Gitea remote
  (--branches for every branch). Refuses to push to a GitHub remote, prints
  what it did, exits non-zero when the mirror could not be updated.
- scripts/hooks/pre-push — git has no post-push hook, so the mirror runs before
  a push that includes prod/main or a tag; skips other remotes, deletions and
  its own recursion.
- scripts/hooks/post-merge — refreshes the mirror after `git pull`/merge on
  prod, which is how a PR squash-merged on GitHub reaches the mirror.
- scripts/install-git-hooks.sh — one-time per clone; sets
  core.hooksPath=scripts/hooks so the hooks stay versioned with the repo.

Mirror failures are warnings: a Gitea outage never blocks a push to GitHub.
AGENTS.md documents the setup plus the GitHub-only release flow.

Verified: script + hooks exercised for the prod/tag case, the feature-branch
skip, the Gitea-remote skip and the recursion guard; the mirror is idempotent
(no-op when already in sync).

scripts/hooks/post-merge

@@ -0,0 +1,25 @@
+#!/bin/sh
+#
+# post-merge hook — after `git pull`/merge, refresh the Gitea fallback.
+#
+# Installed via `scripts/install-git-hooks.sh` (git core.hooksPath = scripts/hooks).
+# GitHub merges (e.g. a squash-merged PR) happen server-side, so a local
+# `git pull` on prod is the moment to bring the Gitea mirror along.
+#
+# args: $1 = 1 when the merge was a squash, otherwise 0
+
+if [ "${GRIDLINE_MIRROR_RUNNING:-}" = "1" ]; then
+  exit 0
+fi
+
+branch="$(git symbolic-ref --short -q HEAD)" || exit 0
+case "$branch" in
+  prod|main) ;;
+  *) exit 0 ;;
+esac
+
+root="$(git rev-parse --show-toplevel)" || exit 0
+GRIDLINE_MIRROR_RUNNING=1 sh "$root/scripts/mirror-gitea.sh" ||
+  echo "post-merge: warning: Gitea mirror was not updated" >&2
+
+exit 0