chore(mirror): keep the Gitea fallback current from local git (#38)

GitHub is the source of truth; Gitea (origin) is a just-in-case copy that had
drifted two commits behind. Rather than require a credential on GitHub's side
or convert the repo to a read-only Gitea mirror, wire it into the local
workflow:

- scripts/mirror-gitea.sh — pushes prod + all tags to the Gitea remote
  (--branches for every branch). Refuses to push to a GitHub remote, prints
  what it did, exits non-zero when the mirror could not be updated.
- scripts/hooks/pre-push — git has no post-push hook, so the mirror runs before
  a push that includes prod/main or a tag; skips other remotes, deletions and
  its own recursion.
- scripts/hooks/post-merge — refreshes the mirror after `git pull`/merge on
  prod, which is how a PR squash-merged on GitHub reaches the mirror.
- scripts/install-git-hooks.sh — one-time per clone; sets
  core.hooksPath=scripts/hooks so the hooks stay versioned with the repo.

Mirror failures are warnings: a Gitea outage never blocks a push to GitHub.
AGENTS.md documents the setup plus the GitHub-only release flow.

Verified: script + hooks exercised for the prod/tag case, the feature-branch
skip, the Gitea-remote skip and the recursion guard; the mirror is idempotent
(no-op when already in sync).

scripts/install-git-hooks.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+#
+# Install the repo's git hooks (once per clone).
+#
+# Points `core.hooksPath` at `scripts/hooks/` so the hook files are versioned
+# with the repo instead of copied into `.git/hooks` (a stale copy can't drift
+# out of date this way). Currently:
+#
+#   pre-push   — mirror prod + tags to the Gitea fallback (git.ranio.xyz)
+#   post-merge — same, after a `git pull`/merge while on prod
+#
+# The mirror itself lives in `scripts/mirror-gitea.sh`; run it by hand any time
+# with `scripts/mirror-gitea.sh`. Gitea is a just-in-case copy: GitHub is the
+# source of truth, and a Gitea outage never blocks a push.
+
+set -euo pipefail
+
+repo_root="$(git rev-parse --show-toplevel 2>/dev/null)" || {
+  echo "install-git-hooks: not inside a git repository" >&2
+  exit 1
+}
+cd "$repo_root"
+
+if [ ! -d scripts/hooks ]; then
+  echo "install-git-hooks: scripts/hooks/ is missing — run this from the repo root" >&2
+  exit 1
+fi
+
+chmod +x scripts/hooks/* scripts/mirror-gitea.sh 2>/dev/null || true
+git config core.hooksPath scripts/hooks
+
+gitea_remote="${GRIDLINE_GITEA_REMOTE:-origin}"
+echo "install-git-hooks: core.hooksPath -> scripts/hooks"
+for hook in scripts/hooks/*; do
+  echo "install-git-hooks:   $(basename "$hook")"
+done
+echo "install-git-hooks: prod + tags mirror to the '$gitea_remote' remote on push/pull"