feat(harness): context map, @AGENTS.md single source, contexts rule, and commit-msg + anti-bypass hooks

[keli-wen]

Summary

Bootstrap the agent-and-contributor harness: a path-scoped rule, two hooks (one git, one agent), and a design doc that explains how the pieces fit and how Claude Code and Codex stay aligned. This is the first implementation slice of the harness work; it adds no runtime/library behavior.

Rule — contexts authoring, surfaced just-in-time

• .claude/rules/contexts-authoring.md is a path-scoped Claude Code rule (paths: contexts/**) that loads the contexts authoring standard when an agent edits a contexts/ page. It is thin and points at the canonical write-contexts.md rather than duplicating it. The structural rules themselves are already hard-enforced by tests/test_contexts.py; this rule just helps an agent get them right up front.
• Codex is deliberately not given a parallel file: its .codex/rules/ are an execution-policy allowlist (not path-scoped instructions), and its closest instruction equivalent is a coarser nested AGENTS.md. The asymmetry is documented in the harness doc instead of worked around.

Git hook — commit message format

• scripts/hooks/commit_msg_check.py, wired as a commit-msg stage in .pre-commit-config.yaml, rejects a non-English (CJK) or non-Conventional-Commit subject line. It is tool-agnostic: a human, Claude, or Codex all trigger it because git invokes it. scripts/pre-commit-setup.sh now installs the commit-msg hook type.

Agent hook — no verification bypass

• scripts/hooks/pre_tool_use_no_bypass.py is a shared PreToolUse guard invoked from both .claude/settings.json and .codex/hooks.json. It denies a Bash git command that carries --no-verify, which would otherwise skip the commit-msg / pre-commit / pre-push checks. This is the one guarantee a git hook cannot self-enforce (that flag is what turns git hooks off), so it lives at the agent layer. It is a mechanical check only.

Doc

• contexts/dev/harness-engineering.md documents the enforcement layers (CI is the only floor for external contributors; local git hooks and agent controls sit on top), the Claude-vs-Codex mechanism map (the word "rules" means different things on each side), the principle of aligning content by default and behavior (a shared hook) only for hard guarantees, and a canonical-source table. Registered in contexts/dev/README.md. It cites the Claude Code best-practices, Claude Code rules, and Codex hooks docs.

Context map and single-source agent instructions

• contexts/CONTEXT_MAP.md is the navigation index for contexts/: a directory map with a one-line purpose per page, and a task-to-page route table. AGENTS.md points here as the first read, and it is registered in contexts/README.md.
• AGENTS.md becomes the single source of repository instructions. CLAUDE.md is reduced to an @AGENTS.md import (plus a human-only HTML comment), so the two guides can no longer drift by hand; Claude Code expands the import at load. tests/test_contexts.py gains a _guide_text helper that inlines @path imports, so its literal-content assertions still hold for CLAUDE.md.

Anti-bypass guard: precise matching

The guard tokenizes the command with shlex, splits on shell operators, strips leading VAR=value and prefix words (env / command / sudo / ...), and denies only when --no-verify is a real argument token of a real git invocation. A command that merely mentions the flag inside a quoted string (a doc example, a grep, a commit message, a JSON test payload) keeps it inside one token and passes. It fails open on unbalanced quotes. Residual gap: shell indirection such as $VAR expansion or eval is not resolved, which is out of scope for a mechanical guard.

An earlier substring version denied any command that mentioned the flag; that false positive surfaced live while building this PR and is fixed in the second commit, with tests for the previously-blocked cases and a live confirmation that echoing the literal is no longer denied.

Not in this PR

• CI PR-title lint: the server-side floor that enforces the commit convention for external contributors (local git hooks only fire for those who ran pre-commit install). Separate follow-up, noted in the harness doc.

Related Issue

Part of #134.

Verification

• bash scripts/verify.sh passes: ruff format + ruff check + basedpyright + import-linter + pytest --cov (426 passed, 85.66% coverage).
• Both hook scripts manually exercised: the commit-msg check exits 0 on a valid subject and 1 on CJK / non-conventional; the anti-bypass guard denies a git + no-verify command and passes everything else. Both also covered by tests/hooks/.
• No live-network smoke test applies: this PR touches harness config, hook scripts, a rule, and a contexts page; it changes no public operation or source.

Checklist

• The title uses English Conventional Commit format: type(scope): summary.
• The related issue or design discussion is linked when applicable.
• bash scripts/verify.sh passes.
• Every applicable live-network component smoke test passes, or this PR states why none applies.
• Public behavior has focused tests, an example, and documentation where applicable.
• The PR is complete, small, and contains no unrelated changes.